Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Analysis ID:	1427735
MD5:	e1d8325b086f91769120381b78626e2e
SHA1:	0eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256:	b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
Tags:	exe
Infos:

Detection

Glupteba, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected Glupteba

Yara detected PureLog Stealer

Yara detected UAC Bypass using CMSTP

Yara detected zgRAT

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

Creates HTML files with .exe extension (expired dropper behavior)

Disable Windows Defender real time protection (registry)

Disables UAC (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Drops script or batch files to the startup folder

Exclude list of file types from scheduled, custom, and real-time scanning

Found Tor onion address

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies Group Policy settings

PE file contains section with special chars

Sample uses process hollowing technique

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Windows Defender Exclusions Added - Registry

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" MD5: E1D8325B086F91769120381B78626E2E)

powershell.exe (PID: 7484 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7964 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

CasPol.exe (PID: 7520 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

JPl4ZLOvy3fY5RSXGk5s9Gl5.exe (PID: 7912 cmdline: "C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe" MD5: 3A4982B7D2352FB3089C01B9F33C25EB)

JIsbjewlnghreiCB15kllzTk.exe (PID: 7992 cmdline: "C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

7ifrWkUACu1QmnINWqs0eu9h.exe (PID: 8008 cmdline: "C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

T2RIU3FpH6dczIGTG32vuvvE.exe (PID: 8100 cmdline: "C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe" --silent --allusers=0 MD5: EF199316DF30CB4E02F45F156EC63A9A)

T2RIU3FpH6dczIGTG32vuvvE.exe (PID: 8168 cmdline: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8 MD5: EF199316DF30CB4E02F45F156EC63A9A)

T2RIU3FpH6dczIGTG32vuvvE.exe (PID: 5740 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe" --version MD5: EF199316DF30CB4E02F45F156EC63A9A)

KI5P6OyhHMwNaNA4w0xtd3UY.exe (PID: 8124 cmdline: "C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe" MD5: A25CDF843E60F609B970AC9414170A7A)

XEAazEoSTmJSOa66cXm6S07v.exe (PID: 2668 cmdline: "C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe" MD5: 3A4982B7D2352FB3089C01B9F33C25EB)

QHuPF3k4no0JL9DdGqDYtkCG.exe (PID: 6480 cmdline: "C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

Yz2gr4IqEnTCH1g642bo4hrO.exe (PID: 7016 cmdline: "C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

3wiDjAuNAMEeKc2Sp8AJvkHN.exe (PID: 7300 cmdline: "C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe" MD5: A25CDF843E60F609B970AC9414170A7A)

syLcQZGPHHUJ3M0wbg0XxQZf.exe (PID: 5496 cmdline: "C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe" --silent --allusers=0 MD5: C2F0D0D1B405D1F1476B802BE5DD2ED3)

syLcQZGPHHUJ3M0wbg0XxQZf.exe (PID: 8040 cmdline: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8 MD5: C2F0D0D1B405D1F1476B802BE5DD2ED3)

wjaGPzkDQjpdcbjBR9AwSFKW.exe (PID: 8044 cmdline: "C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe" MD5: 5D5DA0738299D8893B79A6C926765E5F)

Install.exe (PID: 6740 cmdline: .\Install.exe /sQwdidHh "385118" /S MD5: E77964E011D8880EAE95422769249CA4)

SU1be6oqYDorLkUc1l6IPPFB.exe (PID: 7896 cmdline: "C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe" MD5: 3A4982B7D2352FB3089C01B9F33C25EB)

Vh2fqCjm9jPtwuJrcfbbwxLj.exe (PID: 7660 cmdline: "C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

PqdYh9kiVSkf3FjC9RDfcS2e.exe (PID: 7768 cmdline: "C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

0XytwVHS3WE9jtGuuRid6GiP.exe (PID: 7216 cmdline: "C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe" --silent --allusers=0 MD5: CD54757EAFA70E59850F77982FAFCB49)

0XytwVHS3WE9jtGuuRid6GiP.exe (PID: 4476 cmdline: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8 MD5: CD54757EAFA70E59850F77982FAFCB49)

0XytwVHS3WE9jtGuuRid6GiP.exe (PID: 2764 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe" --version MD5: CD54757EAFA70E59850F77982FAFCB49)

mm4Q31XfpYKjbn6ceSwXhER9.exe (PID: 1068 cmdline: "C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe" MD5: 3A4982B7D2352FB3089C01B9F33C25EB)

GGlApx2WKpOBsEMsKqplE6Uf.exe (PID: 5780 cmdline: "C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe" MD5: A25CDF843E60F609B970AC9414170A7A)

1HakjlIwxygCinOPkQfhRxwL.exe (PID: 3852 cmdline: "C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

F6G6Y5cEUOHQw9dTwu4nNoIO.exe (PID: 5472 cmdline: "C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

kuRSiZPmKhbW1guMqYXCvrAu.exe (PID: 6404 cmdline: "C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe" --silent --allusers=0 MD5: B1D3A17EDD5DACC6B98BEC740C1B4A2F)

kBnX25PRDA3FRCf96qRj6qpV.exe (PID: 7052 cmdline: "C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe" MD5: A25CDF843E60F609B970AC9414170A7A)

CasPol.exe (PID: 7540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

WerFault.exe (PID: 7716 cmdline: C:\Windows\system32\WerFault.exe -u -p 7412 -s 1156 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7572 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7668 cmdline: C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cmd.exe (PID: 7692 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oE07FMGKijbqRxoSOEfcVNr4.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe" MD5: 281F44C8C6F0CFBC293E1FDB8B3EE782)

svchost.exe (PID: 5052 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3104 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1308 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xcb387:$s1: file:/// 0xcb297:$s2: {11111-22222-10009-11112} 0xcb317:$s3: {11111-22222-50001-00000} 0xc9fdb:$s4: get_Module 0x41c0ea:$s4: get_Module 0xc2f8e:$s5: Reverse 0x41abeb:$s5: Reverse 0x41ad57:$s6: BlockCopy 0xc0864:$s7: ReadByte 0x40f9a2:$s7: ReadByte 0xcb399:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Local\Temp\u224.1.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\u63s.1.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1760:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000017.00000002.3372271879.0000000002E60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1588:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000008.00000003.2351558121.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000017.00000002.3387263069.0000000002F7E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1628:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe PID: 7412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe PID: 7412	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.CasPol.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe.1e7b7d49938.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0.2.SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe.1e7b7d46ef8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, ParentProcessId: 7412, ParentProcessName: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, ProcessId: 7484, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe, ProcessId: 8124, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, ParentProcessId: 7412, ParentProcessName: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force, ProcessId: 7484, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7572, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 7520, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	Avira: detection malicious, Label: HEUR/AGEN.1310450
Source: C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Source: C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	Virustotal: Detection: 47%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Virustotal: Detection: 47%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	ReversingLabs: Detection: 23%
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Virustotal: Detection: 21%			Perma Link

Yara detected Glupteba

Source: Yara match	File source: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660, type: MEMORYSTR

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\setup294[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe PID: 7412, type: MEMORYSTR

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660, type: MEMORYSTR

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Unpacked PE file: 8.2.JPl4ZLOvy3fY5RSXGk5s9Gl5.exe.400000.0.unpack
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Unpacked PE file: 15.2.XEAazEoSTmJSOa66cXm6S07v.exe.400000.0.unpack
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Unpacked PE file: 23.2.SU1be6oqYDorLkUc1l6IPPFB.exe.400000.0.unpack

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023618399.log
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023635601.log
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023630151.log
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023639593.log

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000350B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\rif.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2160641727.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C315FF2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2138485669.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C31601A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: "C:\bazut.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3336654338.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000000.1671086635.000000000041A000.00000002.00000001.01000000.00000007.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3379557412.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000000.1745083887.000000000041A000.00000002.00000001.01000000.0000000D.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3389956114.0000000002FB7000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000000.1842263103.000000000041A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: wextract.pdbH source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000350B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\fidizinuhufi\zicavudojel-cugusanek_gaz.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135649699.000001C316201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bazut.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3336654338.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000000.1671086635.000000000041A000.00000002.00000001.01000000.00000007.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3379557412.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000000.1745083887.000000000041A000.00000002.00000001.01000000.0000000D.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3389956114.0000000002FB7000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000000.1842263103.000000000041A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\batexozecode 78_gu.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000000.1682392909.000000000041A000.00000002.00000001.01000000.00000008.sdmp, 7ifrWkUACu1QmnINWqs0eu9h.exe, 0000000B.00000000.1683701177.000000000041A000.00000002.00000001.01000000.00000009.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188271107.000001C3168EC000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183852313.000001C31675A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2171495094.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2187695382.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2175070782.000001C316228000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201691097.000001C317103000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177725105.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2204051794.000001C31699F000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184196785.000001C316271000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182555067.000001C316622000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188586155.000001C316738000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2186821319.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188931136.000001C316B3E000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2189325898.000001C316EB0000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2191286929.000001C316624000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177566461.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188346464.000001C316626000.00000004.00000020.00020000.00000000.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000000.1751272697.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3350968416.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000000.1762856940.000000000041A000.00000002.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000000.1856174156.000000000041A000.00000002.00000001.01000000.00000015.sdmp, PqdYh9kiVSkf3FjC9RDfcS2e.exe, 0000001B.00000002.3326421294.000000000041A000.00000002.00000001.01000000.00000016.sdmp, F6G6Y5cEUOHQw9dTwu4nNoIO.exe, 00000028.00000000.1982328768.000000000041A000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Extension Installer\Extension Installer\obj\x64\Release\Extension Installer.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182563385.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180544126.000001C315F4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 2C:\batexozecode 78_gu.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000000.1682392909.000000000041A000.00000002.00000001.01000000.00000008.sdmp, 7ifrWkUACu1QmnINWqs0eu9h.exe, 0000000B.00000000.1683701177.000000000041A000.00000002.00000001.01000000.00000009.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188271107.000001C3168EC000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183852313.000001C31675A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2171495094.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2187695382.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2175070782.000001C316228000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201691097.000001C317103000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177725105.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2204051794.000001C31699F000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184196785.000001C316271000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182555067.000001C316622000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188586155.000001C316738000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2186821319.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188931136.000001C316B3E000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2189325898.000001C316EB0000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2191286929.000001C316624000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177566461.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188346464.000001C316626000.00000004.00000020.00020000.00000000.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000000.1751272697.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3350968416.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000000.1762856940.000000000041A000.00000002.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000000.1856174156.000000000041A000.00000002.00000001.01000000.00000015.sdmp, PqdYh9kiVSkf3FjC9RDfcS2e.exe, 0000001B.00000002.3326421294.000000000041A000.00000002.00000001.01000000.00000016.sdmp, F6G6Y5cEUOHQw9dTwu4nNoIO.exe, 00000028.00000000.1982328768.000000000041A000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: H,C:\rif.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2160641727.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C315FF2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2138485669.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C31601A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Loader.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3388944185.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000000.1698025861.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3351524981.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1720567697.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000000.1821750116.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3404841613.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000000.1855030242.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322123823.00000000000B7000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137349849.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137178358.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C31601A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137349849.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137687774.000001C316273000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\sez\cekeber\cevevas.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004A10000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3404845206.0000000004B20000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3408267639.0000000004B60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\xudiwojabogaji\pixev41 ru.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180979215.000001C31606C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180871105.000001C316233000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C31629B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183857159.000001C3162BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: .pdb.dbg source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\sez\cekeber\cevevas.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004A10000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3404845206.0000000004B20000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3408267639.0000000004B60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BackgroundTransferHost.pdb source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: XC:\xudiwojabogaji\pixev41 ru.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180979215.000001C31606C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180871105.000001C316233000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C31629B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183857159.000001C3162BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BackgroundTransferHost.pdbGCTL source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: GC:\fidizinuhufi\zicavudojel-cugusanek_gaz.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135649699.000001C316201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3388944185.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000000.1698025861.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3351524981.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1720567697.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000000.1821750116.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3404841613.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000000.1855030242.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322123823.00000000000B7000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_0040553A FindFirstFileA,		22_2_0040553A
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		22_2_004055DE

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\

Networking

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: EEmi2L6GuCPkhaixWFWgtXmC.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: mLelSKT2LDJXIBhhiZbtJLRy.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: dNJx8I5qbjWEp5UtzqYCiiad.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: lxJL7FOaOc6Tkk0XNttI4ctE.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: JsR15JaJDFzaXbSvvkMXKGOy.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: gRYJFiU6bkvQhx8faYvTd9ih.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: QI8XvF6duFZ0OdsmbJPQIRnh.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: VBK0acBbP8jSA9iTV62oCIGo.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: KWbVzicuAiSBYHryJZst17v9.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: bxrHv2BMlcULxp3nGjO9PIeE.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: Kocn1QGnt5lNON74XhjpO8L3.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: sZo8dt9VSX8cm31TuXOiptH3.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: jvm8OUFmYtzvgwR72YgLOVLo.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: c02zgoz7VFjrBiCTIiJdXKzh.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: YZSfYHwWFKrX6Pjkpe42m3a3.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: D1DNzbYhZ5irlEMiXjcU2a2e.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: YGTS10whU5xLzk2bVxVWnmYS.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: oQDwIFVWS8CDFis7e7hIkdVf.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: dTzJTeCvH5akGV8vPoopaG4c.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: OwiOgmO3oIyIM5MtwxyFTS2j.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: zU6BSyD8WoQsImtLem5lAF2x.exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 72ikwo0xN8m7DIEmg8FL68i9.exe.3.dr
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: q8kYHwm3PccnSPsq8WHAVhzd.exe.13.dr
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: t1TVh5wiN6nn0UU6UNFGbozD.exe.13.dr

Found Tor onion address

Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe.1e7b7d49938.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe.1e7b7d46ef8.1.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_004263E5 __EH_prolog,WSAStartup,socket,WSACleanup,gethostbyname,htons,connect,send,send,recv,recv,recv,recv,recv,WSACleanup,closesocket,

8_2_004263E5

Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: OS X; U; en) Presto/2.6.30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: internal error: handshake returned an error but is marked successfultls: received unexpected handshake message of type %T when waiting for %T equals www.facebook.com (Facebook)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.facebook.com (Facebook)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.twitter.com (Twitter)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.youtube.com (Youtube)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.facebook.com (Facebook)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.twitter.com (Twitter)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline' equals www.youtube.com (Youtube)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline'% equals www.facebook.com (Facebook)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline'% equals www.twitter.com (Twitter)
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline'% equals www.youtube.com (Youtube)
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: o Debian/1.6-7Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916 equals www.facebook.com (Facebook)

Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.59/ISetup2.exe
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.175/server/ww15/AppGate2103v15.exe
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.64.17
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.64.17/files/InstallCharityEngine_7.14.2_S16-01.exe$n
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.64.17/files/setup.exe
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.64.17/files/setup.exe$n
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EB6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/download.php?pub=inte
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2128178380.000001C315F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/download.php?pub=inte$
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/download.php?pub=inte-J
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/download.php?pub=intekJ
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.php
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php9J
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpsJ(
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.iolo.net
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)SonyEricssonK550i/R1JD
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767__123
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1916115431.00007FF78980B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://richclarkdesign.com
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls:
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.alltheweb.com/help/webmaster/crawler)Mozilla/5.0
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.bloglines.com)Frame
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.everyfeed.com)explicit
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.google.c
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.google.com/bot.html)crypto/ecdh:
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2151788726.000001C316035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000003.1869063183.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000003.2122360742.000000000392A000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.opera.com0
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://www.spidersoft.com)
Source: 3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1863098808.00007FF788E51000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://yandex.com/bots)Opera
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.tiktok.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.geo.opera.com/geolocation/OperaDesktophttps://cr
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2162785597.000001C315F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exeUniverse
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: https://blockstream.info/apiinva
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.574859385.xyz/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.574859385.xyz/525403/setup.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/bfdb39976dca392638e6450f1175fa96/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.syndication.twimg.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.facebook.net
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://counter.yadro.ru/hit?
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3375978715.0000000001540000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3411019967.0000000026E24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3312401333.0000000000C08000.00000004.00000020.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3379675307.000000004E414000.00000004.00001000.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3375978715.0000000001548000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3410961097.0000000026E14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3397102920.000000004E4B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit--monitor-self-annotation=ptype=crashpad-hand
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3379731294.000000004E424000.00000004.00001000.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3411019967.0000000026E24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit0x298
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3397102920.000000004E4B0000.00000004.00001000.00020000.00000000.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3387261111.000000004E454000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitC:
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3388590431.000000004E45C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitNE
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3387261111.000000004E454000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitNEB
Source: 0XytwVHS3WE9jtGuuRid6GiP.exe, 0000001C.00000002.3375964765.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
Source: 0XytwVHS3WE9jtGuuRid6GiP.exe, 0000001C.00000002.3375964765.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/2
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197680891.000001C316094000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.vk.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gamemaker.io
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gamemaker.io)
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gamemaker.io/en/education.
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gamemaker.io/en/get.
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174178888.000001C315F91000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2155661442.000001C315F3D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F3D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2176714058.000001C315F91000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigachadfanclub.org/bfdb39976dca392638e6450f1175fa96/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigachadfanclub.org/bfdb39976dca392638e6450f1175fa96/7725eaa6592c80f8124e769b4e8a07f7.exe4V
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: https://github.com/Snawoot/opera-proxy/releases/download/v1.2.2/opera-proxy.windows-386.exeBlackBerr
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://googletagmanager.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://help.instagram.com/581066165581870;
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://help.opera.com/latest/
Source: 3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1863098808.00007FF788E51000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/status
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/1djqU4
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/privacy/
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/rules/
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jonathantwo.com
Source: CasPol.exe, 00000003.00000002.3402975175.0000000003587000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000356B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jonathantwo.com/bfdb39976dca392638e6450f1175fa96/6779d89b7a368f4f3f340b50a9d18d71.exe
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://legal.opera.com/privacy
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://legal.opera.com/privacy.
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://legal.opera.com/terms
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://legal.opera.com/terms.
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/crypto/rc4:
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=login
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=logout&hash=ff5c930db01817b629&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://management.azure.cominvalid
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://management.chinacloudapi.cnP224
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://management.core.chinacloudapi.cnchacha20poly1305:
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://management.core.usgovcloudapi.netGODEBUG
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://management.usgovcloudapi.nethttps://management.core.windows.net/edwards25519:
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/:
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exe$
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exeV
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exeb
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exez
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top:80/style/060.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe(
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeom/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exep
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/z
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://opera.com/privacy
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/V6VJsrV3
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B7D38000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3311663112.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/V6VJsrV31https://yip.su/RNWPd.exe7https://iplogger.com/1djqU4
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://platform.twitter.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://policies.google.com/terms;
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://r.mradx.net
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsonsize
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://redir.opera.com/uninstallsurvey/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skategirls.org
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://sourcecode.opera.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/base.7c74f023.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2226129974.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/common.1545e5c6.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/fonts_cnt.c7a76efe.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/fonts_utf.7fa94ada.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/ui_common.eebaf9c8.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/uncommon.6d51982c.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/vk_sans_display.5625d45f.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/vk_sans_display_faux.7d208ecb.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/al/vkui.43318ab6.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.89b663a3.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.93b52d88.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/common.468f0071.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/palette.361d379a.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/palette.434ea2ce.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/react.759f82b6.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/state-management.c22f9f68.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit-icons.826b9222.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit.5f623236.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit.d0208b10.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkui.bce4c996.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/common_web.4f7e5a9b.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/common_web.8c23e2d5.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/css_types.1bff1a5b.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/docs.20074c02.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/docs.6e23ec02.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/error_monitoring_classic.isolated.99143b54.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/grip.0b3b493f.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/jobs_devtools_notification.14f96f02.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/likes.20074c02.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/likes.72a3dfff.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/page_layout.7b5800c2.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/performance_observers.4d12f60f.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/polyfills.isolated.edaffb7b.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/raven_logger.ea0a2239.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/site_layout.20074c02.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/site_layout.f88780c8.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/ui_common.20074c02.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/ui_common.48463b06.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/unauthorized.20074c02.css
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/unauthorized.4bbc412d.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-22.vk.com/dist/web/vk_sans_observer.fb28db65.js
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/Extension__Installer.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/Extension__Installer.exe(
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/Extension__Installer.exej?
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/Extension__Installer.exetop/n?
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/N?
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/f?
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/nts
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org/om/525403/setup.exer-end-point:R
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org:80/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starsmm.org:80/Extension__Installer.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.vk.me
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stats.vk-portal.net
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c236331/u5294803/docs/d24/3cad94b79c70/imgdrive_2_1.bmp?extra=KSt_51f-h8
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c237231/u5294803/docs/d31/2c3cba4b3eec/crypted.bmp?extra=fe0yzYV1eeDufHZ
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2255016281.000001C315F78000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E9B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2239264411.000001C315F70000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250448749.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c909328/u5294803/docs/d12/eb1afcc538fd/PL_Clients.bmp?extra=iwYpYeMLSGBx
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250448749.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c909328/u5294803/docs/d54/8868a626addc/files.bmp?extra=4Jh-lFC-FBDEqT-xO
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250448749.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-22.userapi.com/c237231/u5294803/docs/d32/903bb9f1994d/crypted.bmp?extra=tvJKau_p37EHNlc
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tagmanager.google.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://telegram.org/tos/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ton.twimg.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/B
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137349849.000001C316201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe:
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exej
Source: JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://twitter.com/en/tos;
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/0u0uDuw
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/Nuq
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?de
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E8A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc329118071_676580549?hash=pFVdCz3lOS502jpZ4S1mZuaA9EuN2MatBz9F2cxg7Ac&dl=ej7ecTKnt3
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668512951?hash=uac9wbeb45bZZ2A4Vgx1xpUTavuZvoy56VWHrfJX9iH&dl=BnUuPvvpE2Gl
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668652542?hash=KlAQZ4zXtzzV5eLSZ1KaXKdCOpfsWxOfH5GyV92XrPL&dl=yPhjzrub8w5M
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668661395?hash=uQQoAVY7lWMuchlYkCFbK0P2SVazuAiimzHIh07ASrs&dl=WO5eZhu0JdqJ
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668706588?hash=Cas6KM0FtrzNQfYftz7JyxKZDtxiBfna0d31zWD3F1L&dl=EtRQUHZNtDlx
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_668661395?hash=uQQoAVY7lWMuchlYkCFbK0P2SVazuAiimzHIh07ASrs&dl=WO5eZhu0J
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.ru
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.opera.com
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.opera.com..
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.opera.com/
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.opera.com/download/
Source: syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.opera.com/privacy
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.whatsapp.com/legal;
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yastatic.net
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd.exe
Source: CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/redirect-

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000017.00000002.3372271879.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000017.00000002.3387263069.0000000002F7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

PE file contains section with special chars

Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Windows\System32\GroupPolicy\Machine
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Windows\System32\GroupPolicy\User
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B889B78	0_2_00007FFD9B889B78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B889B70	0_2_00007FFD9B889B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B88586D	0_2_00007FFD9B88586D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B885660	0_2_00007FFD9B885660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B88CDE9	0_2_00007FFD9B88CDE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B895E1C	0_2_00007FFD9B895E1C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B88AF5D	0_2_00007FFD9B88AF5D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B895E69	0_2_00007FFD9B895E69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B891595	0_2_00007FFD9B891595
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040BA80	8_2_0040BA80
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040C2AC	8_2_0040C2AC
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_004123A0	8_2_004123A0
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040F441	8_2_0040F441
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0042140C	8_2_0042140C
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040BD2A	8_2_0040BD2A
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0041BE39	8_2_0041BE39
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040C6A0	8_2_0040C6A0
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00408761	8_2_00408761
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040B70E	8_2_0040B70E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0041B722	8_2_0041B722
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0040BFF1	8_2_0040BFF1
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049ABCE7	8_2_049ABCE7
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AC513	8_2_049AC513
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AF6A8	8_2_049AF6A8
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049B2607	8_2_049B2607
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049ABF91	8_2_049ABF91
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049BB989	8_2_049BB989
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A89C8	8_2_049A89C8
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AC907	8_2_049AC907
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AB975	8_2_049AB975
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AC258	8_2_049AC258
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B92E700	14_2_6B92E700
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9A97AC	14_2_6B9A97AC
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B87F9D0	14_2_6B87F9D0
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B98A160	14_2_6B98A160
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9AD960	14_2_6B9AD960
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9D0CBA	14_2_6B9D0CBA
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B96E0D0	14_2_6B96E0D0
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9CE8F9	14_2_6B9CE8F9
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9AA43D	14_2_6B9AA43D
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040BA80	15_2_0040BA80
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040C2AC	15_2_0040C2AC
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_004123A0	15_2_004123A0
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040F441	15_2_0040F441
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0042140C	15_2_0042140C
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040BD2A	15_2_0040BD2A
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0041BE39	15_2_0041BE39
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040C6A0	15_2_0040C6A0
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00408761	15_2_00408761
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040B70E	15_2_0040B70E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0041B722	15_2_0041B722
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0040BFF1	15_2_0040BFF1
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDC258	15_2_02EDC258
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED89C8	15_2_02ED89C8
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EEB989	15_2_02EEB989
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDB975	15_2_02EDB975
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDC907	15_2_02EDC907
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDF6A8	15_2_02EDF6A8
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EE2607	15_2_02EE2607
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDBF91	15_2_02EDBF91
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDBCE7	15_2_02EDBCE7
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDC513	15_2_02EDC513
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_004162A6	22_2_004162A6
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_0040E5A5	22_2_0040E5A5
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_004126B0	22_2_004126B0
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_00403A01	22_2_00403A01
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_00418EF1	22_2_00418EF1
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_00418FCB	22_2_00418FCB

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: String function: 00409CC0 appears 48 times
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: String function: 049A9F27 appears 48 times
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: String function: 00427488 appears 43 times
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: String function: 049C76EF appears 43 times
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: String function: 02ED9F27 appears 48 times
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: String function: 02EF76EF appears 43 times
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: String function: 00409CC0 appears 48 times
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: String function: 00427488 appears 43 times
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: String function: 00403A9C appears 33 times
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: String function: 00413954 appears 177 times
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: String function: 6B9D98A0 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: invalid certificate

Source: i3cGHUfhs02OIuQ54eKiruit.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: LLoAVhqqC3TlPmj3xeFbhIJr.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: x6grxPSTyIeA8EPDMgptrwYO.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: T2RIU3FpH6dczIGTG32vuvvE.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows

Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: Number of sections : 12 > 10

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2720344847.000001E7C7EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUlacufekomiqewoF vs SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B7D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNew.exe" vs SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000000.1628758907.000001E7B5D74000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUbazafeH vs SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411204434.000001E7B7AE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUlacufekomiqewoF vs SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Source: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000017.00000002.3372271879.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000017.00000002.3387263069.0000000002F7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@132/280@0/41

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe

Code function: 14_2_6B889C20 FormatMessageW,GetLastError,LocalFree,

14_2_6B889C20

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_02F1F78E CreateToolhelp32Snapshot,Module32First,

8_2_02F1F78E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File created: C:\Users\user\AppData\Local\lxJL7FOaOc6Tkk0XNttI4ctE.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_15
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7412

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfx1wdjg.dd1.ps1

Jump to behavior

Source: Yara match	File source: 00000008.00000003.2351558121.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\u224.1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\u63s.1.exe, type: DROPPED

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat" "

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: one	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: one	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: two	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: two	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: three	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: three	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: four	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: four	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: five	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: five	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: six	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: six	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: seven	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: seven	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: eight	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: eight	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: nine	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: nine	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: ten	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: ten	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: one	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: two	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: three	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: four	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: five	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: six	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: seven	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: eight	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: nine	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: ten	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: Installed	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: Installed	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_00424A0E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: @	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: one	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: one	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: two	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: two	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: three	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: three	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: four	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: four	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: five	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: five	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: six	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: six	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: seven	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: seven	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: eight	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: eight	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: nine	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: nine	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: ten	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: ten	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.90	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: Installed	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: Installed	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.59	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /syncUpd.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: 185.172.128.228	8_2_049C4C75
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Command line argument: /BroomSetup.exe	8_2_049C4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: one	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: one	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: two	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: two	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: three	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: three	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: four	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: four	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: five	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: five	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: six	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: six	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: seven	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: seven	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: eight	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: eight	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: nine	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: nine	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: ten	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: ten	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: one	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: two	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: three	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: four	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: five	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: six	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: seven	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: eight	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: nine	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: ten	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: Installed	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: Installed	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_00424A0E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: @	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: one	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: one	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: two	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: two	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: three	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: three	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: four	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: four	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: five	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: five	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: six	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: six	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: seven	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: seven	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: eight	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: eight	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: nine	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: nine	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: ten	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: ten	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.90	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: Installed	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: Installed	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.59	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /syncUpd.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: 185.172.128.228	15_2_02EF4C75
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Command line argument: /BroomSetup.exe	15_2_02EF4C75
Source: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe	Command line argument: nOA	16_2_00414EC0

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1863098808.00007FF788E51000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1863098808.00007FF788E51000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	ReversingLabs: Detection: 23%
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Virustotal: Detection: 21%

Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: JIsbjewlnghreiCB15kllzTk.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7412 -s 1156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe "C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe "C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe "C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe "C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe "C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe"
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe "C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe "C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe "C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe "C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe "C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe" --silent --allusers=0
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe "C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe "C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe "C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe "C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe "C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe" --silent --allusers=0
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe" --version
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe "C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe "C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe "C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe "C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe "C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe"
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe" --version
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe "C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe" --silent --allusers=0
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe .\Install.exe /sQwdidHh "385118" /S
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe "C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe "C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe "C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe "C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe "C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe "C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe "C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe "C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe "C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe "C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe "C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe "C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe "C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe "C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe "C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe "C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe "C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe "C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe "C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe "C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe "C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe "C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7412 -s 1156
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe" --version
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe .\Install.exe /sQwdidHh "385118" /S
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe "C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe"
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe" --version
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: edputil.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: slc.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: sppc.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: mpr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: activeds.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: dssec.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: mpr.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: authz.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: webio.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: samcli.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: mpr.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: sfc.dll
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Section loaded: srvcli.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000350B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\rif.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2160641727.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C315FF2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2138485669.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C31601A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: "C:\bazut.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3336654338.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000000.1671086635.000000000041A000.00000002.00000001.01000000.00000007.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3379557412.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000000.1745083887.000000000041A000.00000002.00000001.01000000.0000000D.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3389956114.0000000002FB7000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000000.1842263103.000000000041A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: wextract.pdbH source: CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.000000000350B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\fidizinuhufi\zicavudojel-cugusanek_gaz.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135649699.000001C316201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bazut.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3336654338.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000000.1671086635.000000000041A000.00000002.00000001.01000000.00000007.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3379557412.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000000.1745083887.000000000041A000.00000002.00000001.01000000.0000000D.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3389956114.0000000002FB7000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000000.1842263103.000000000041A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\batexozecode 78_gu.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000000.1682392909.000000000041A000.00000002.00000001.01000000.00000008.sdmp, 7ifrWkUACu1QmnINWqs0eu9h.exe, 0000000B.00000000.1683701177.000000000041A000.00000002.00000001.01000000.00000009.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188271107.000001C3168EC000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183852313.000001C31675A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2171495094.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2187695382.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2175070782.000001C316228000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201691097.000001C317103000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177725105.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2204051794.000001C31699F000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184196785.000001C316271000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182555067.000001C316622000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188586155.000001C316738000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2186821319.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188931136.000001C316B3E000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2189325898.000001C316EB0000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2191286929.000001C316624000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177566461.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188346464.000001C316626000.00000004.00000020.00020000.00000000.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000000.1751272697.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3350968416.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000000.1762856940.000000000041A000.00000002.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000000.1856174156.000000000041A000.00000002.00000001.01000000.00000015.sdmp, PqdYh9kiVSkf3FjC9RDfcS2e.exe, 0000001B.00000002.3326421294.000000000041A000.00000002.00000001.01000000.00000016.sdmp, F6G6Y5cEUOHQw9dTwu4nNoIO.exe, 00000028.00000000.1982328768.000000000041A000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Extension Installer\Extension Installer\obj\x64\Release\Extension Installer.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182563385.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180544126.000001C315F4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 2C:\batexozecode 78_gu.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000000.1682392909.000000000041A000.00000002.00000001.01000000.00000008.sdmp, 7ifrWkUACu1QmnINWqs0eu9h.exe, 0000000B.00000000.1683701177.000000000041A000.00000002.00000001.01000000.00000009.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188271107.000001C3168EC000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183852313.000001C31675A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2171495094.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2187695382.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2175070782.000001C316228000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201691097.000001C317103000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177725105.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2204051794.000001C31699F000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184196785.000001C316271000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182555067.000001C316622000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188586155.000001C316738000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2186821319.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188931136.000001C316B3E000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2189325898.000001C316EB0000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2191286929.000001C316624000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2177566461.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2188346464.000001C316626000.00000004.00000020.00020000.00000000.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000000.1751272697.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3350968416.000000000041A000.00000002.00000001.01000000.0000000E.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000000.1762856940.000000000041A000.00000002.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000000.1856174156.000000000041A000.00000002.00000001.01000000.00000015.sdmp, PqdYh9kiVSkf3FjC9RDfcS2e.exe, 0000001B.00000002.3326421294.000000000041A000.00000002.00000001.01000000.00000016.sdmp, F6G6Y5cEUOHQw9dTwu4nNoIO.exe, 00000028.00000000.1982328768.000000000041A000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: H,C:\rif.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2160641727.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C315FF2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2138485669.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137960546.000001C31601A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Loader.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3388944185.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000000.1698025861.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3351524981.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1720567697.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000000.1821750116.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3404841613.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000000.1855030242.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322123823.00000000000B7000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137349849.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137178358.000001C316026000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C315F94000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135746383.000001C31601A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137349849.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2137687774.000001C316273000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\sez\cekeber\cevevas.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004A10000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3404845206.0000000004B20000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3408267639.0000000004B60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\xudiwojabogaji\pixev41 ru.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180979215.000001C31606C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180871105.000001C316233000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C31629B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183857159.000001C3162BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: .pdb.dbg source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\sez\cekeber\cevevas.pdb source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004A10000.00000004.00000020.00020000.00000000.sdmp, XEAazEoSTmJSOa66cXm6S07v.exe, 0000000F.00000002.3404845206.0000000004B20000.00000004.00000020.00020000.00000000.sdmp, SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3408267639.0000000004B60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BackgroundTransferHost.pdb source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: XC:\xudiwojabogaji\pixev41 ru.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180979215.000001C31606C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180871105.000001C316233000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C31629B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2180696167.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2183857159.000001C3162BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BackgroundTransferHost.pdbGCTL source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: GC:\fidizinuhufi\zicavudojel-cugusanek_gaz.pdb source: KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2135649699.000001C316201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3388944185.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000000.1698025861.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3351524981.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1720567697.0000000000FC7000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000000.1821750116.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3404841613.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000000.1855030242.00000000000B7000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322123823.00000000000B7000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: wjaGPzkDQjpdcbjBR9AwSFKW.exe, 00000016.00000003.1995933643.0000000002043000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Unpacked PE file: 8.2.JPl4ZLOvy3fY5RSXGk5s9Gl5.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Unpacked PE file: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Unpacked PE file: 15.2.XEAazEoSTmJSOa66cXm6S07v.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe	Unpacked PE file: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Unpacked PE file: 23.2.SU1be6oqYDorLkUc1l6IPPFB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe	Unpacked PE file: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Unpacked PE file: 8.2.JPl4ZLOvy3fY5RSXGk5s9Gl5.exe.400000.0.unpack
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Unpacked PE file: 15.2.XEAazEoSTmJSOa66cXm6S07v.exe.400000.0.unpack
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Unpacked PE file: 23.2.SU1be6oqYDorLkUc1l6IPPFB.exe.400000.0.unpack

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, GetConfigurationVariablesPrint.cs

.Net Code: QueueNativeOverlappedDefineDynamicAssembly

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe

Code function: 14_2_6B906BE0 LoadLibraryW,GetProcAddress,

14_2_6B906BE0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp#V

Source: i3cGHUfhs02OIuQ54eKiruit.exe.3.dr	Static PE information: real checksum: 0x5328d2 should be: 0x5329c7
Source: EVcXAn6aSSI07ttXmnvL0m1a.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: oE07FMGKijbqRxoSOEfcVNr4.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: Tp59u6n2uhrgw2uPRJT1mo4o.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: Ckxihb2NQynZLzb7wQqDjQv3.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: TxcN817CnpQUUQpmxVzV0mFT.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: UZEIOb5AJt4PKuFpMNcUE5kB.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: JIsbjewlnghreiCB15kllzTk.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: LLoAVhqqC3TlPmj3xeFbhIJr.exe.3.dr	Static PE information: real checksum: 0x5328d2 should be: 0x5329c7
Source: T2RIU3FpH6dczIGTG32vuvvE.exe.3.dr	Static PE information: real checksum: 0x525c11 should be: 0x525d06
Source: Obg7n5Z5efoxTsQrcye3Rd29.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: ydXU53ROIY0b9rjoj3B1m3C2.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: 5CSwXytovRGWzicTtxKeyiOA.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: QKDjQ5sBUXPsok7hLKm8Jxa7.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: D0v59fae1RRLyzPSbsQoGGZK.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: 7ifrWkUACu1QmnINWqs0eu9h.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: Pn5ZHf0b4pBQKwEbywjz1WNa.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: 4zJ5E9cuigEXwPfwJBBf2Voo.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: Q1ZjqgqRF9GO7rx2KZzJIL2b.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: KZrOTs6FcYbq3nj2hpYsaJil.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1
Source: N96vu2CQjxii1alDjKixgxro.exe.3.dr	Static PE information: real checksum: 0x71d4e should be: 0x71d51
Source: x6grxPSTyIeA8EPDMgptrwYO.exe.3.dr	Static PE information: real checksum: 0x525c11 should be: 0x525d06
Source: WIPtBriceCKAWgIcBS0bein0.exe.3.dr	Static PE information: real checksum: 0x43d14b should be: 0x434bf1

Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: _RDATA
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .N
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .N
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: GNcg3yiDrmzw07ZdoxfNbs1v.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: _RDATA
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .N
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .N
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: MphEWivXVroFMrkzyLgmuj2t.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: _RDATA
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .N
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .N
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: N9QaRzQ0AfOLtw4JsIq3BGlx.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: _RDATA
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .N
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .N
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: dhes16NzxQrsGp1NLOpKhYEG.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: _RDATA
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .N
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .N
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: si8fAgQZyD6Cx4plDNMQadak.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: _RDATA
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .N
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .N
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: xWO4HdGMj74aDnNwcibeJHOS.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: _RDATA
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .N
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .N
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V
Source: KI5P6OyhHMwNaNA4w0xtd3UY.exe.3.dr	Static PE information: section name: .vmp#V

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B887963 push ebx; retf	0_2_00007FFD9B88796A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B8800BD pushad ; iretd	0_2_00007FFD9B8800C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Code function: 0_2_00007FFD9B96026B push esp; retf 4810h	0_2_00007FFD9B960312
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0042D355 push esi; ret	8_2_0042D35E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00427488 push eax; ret	8_2_004274A6
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00409D06 push ecx; ret	8_2_00409D19
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_004097B6 push ecx; ret	8_2_004097C9
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F253B7 push ebp; iretd	8_2_02F253EA
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F21091 pushad ; retf	8_2_02F21092
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F23945 pushad ; retf	8_2_02F2394C
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F2211D push ecx; iretd	8_2_02F2212F
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F2362F push 2B991403h; ret	8_2_02F23636
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F23F54 push 00000061h; retf	8_2_02F23F5C
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049C76EF push eax; ret	8_2_049C770D
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A9F6D push ecx; ret	8_2_049A9F80
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049BC9FD push esp; retf	8_2_049BC9FE
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A9A1D push ecx; ret	8_2_049A9A30
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049BC3FF push esp; retf	8_2_049BC407
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049C1B72 push dword ptr [esp+ecx-75h]; iretd	8_2_049C1B76
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9A495B push ecx; ret	14_2_6B9A496E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0042D355 push esi; ret	15_2_0042D35E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00427488 push eax; ret	15_2_004274A6
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00409D06 push ecx; ret	15_2_00409D19
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_004097B6 push ecx; ret	15_2_004097C9
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED9A1D push ecx; ret	15_2_02ED9A30
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EEC3FF push esp; retf	15_2_02EEC407
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EF1B72 push dword ptr [esp+ecx-75h]; iretd	15_2_02EF1B76
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EEC9FD push esp; retf	15_2_02EEC9FE
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EF76EF push eax; ret	15_2_02EF770D
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED9F6D push ecx; ret	15_2_02ED9F80
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02FB51DF push ebp; iretd	15_2_02FB5212

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\xFUB9mqMmDXHB6bYEudfe3bz.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\tk993DcPKxGC0yxEJOpWA4Uq.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\YEB6goJ_QRA9Ek_PBrASrKDk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\BuKYLuXtWRFvMUw4E6QMnePB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\e5ADH4rW9PcD5gtgsREzjuVn.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\jQql7MG2XChbxjQ6gNLJX8a8.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\zfmWdTyj1A0x7CDHTSCFc6P6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\UEaGlypujmRvmbw2BfkfATn6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\mglK9j1udRLIlNMmqHDs89S5.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\bLSHn6d_smbEd3DDHsdhdb9F.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\8lBOtksKAFB83rUCOP3QmQ2e.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\N3dNHH1i3277Gfb9sVdhVcr5.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\poDcVPAkLsUtWqX_rqUuGuhg.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	Jump to dropped file

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143868168.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Zo2cLek54856t9hHiM76hOvA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\KAKoKagL31aeT9tvPuu3L1bc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\jQql7MG2XChbxjQ6gNLJX8a8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\VZQMh0fhaUDqSIPOKlnYI2fB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\dhes16NzxQrsGp1NLOpKhYEG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\ySa0tmdKXLMzZNFqxzPk3yl0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Q1ZjqgqRF9GO7rx2KZzJIL2b.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\31Q0tfhZ3ZbBeSnpH53Q6cmR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\MphEWivXVroFMrkzyLgmuj2t.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\cOM8IUNCP0DFnISRQRmA27gl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\nRdMq8uD8Vn50SShh8GGGF1J.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\iZp2NZRM4fCHBLrmfY5yxs4H.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\BScYPWRXjjJsm0UZKd8ZE404.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\KV2qLRPax2onnz5Ndu1Z5G5q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\fBaSCDbc3PgwiKtKElJM21wM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\EVcXAn6aSSI07ttXmnvL0m1a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036248045740.dll	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\e5ADH4rW9PcD5gtgsREzjuVn.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\ydXU53ROIY0b9rjoj3B1m3C2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\QKDjQ5sBUXPsok7hLKm8Jxa7.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036332806404.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\v2MiP1iSJrMhmInOYy5QW224.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Extension__Installer[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\IWT1vUWgcWghP1zoHHmuoKa9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\iUqjJmkpzyvK9tYYVEHTZp1W.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\HmEe3wDzeiBBjESYuBab3Xp4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\TxcN817CnpQUUQpmxVzV0mFT.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\JeZCwGu4yuVGGxFvnw3BIkJ1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\f0h4XS72dTppZnfmwBjhUBEA.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\N3dNHH1i3277Gfb9sVdhVcr5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\xWO4HdGMj74aDnNwcibeJHOS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\browserexport.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\BuKYLuXtWRFvMUw4E6QMnePB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\060[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	File created: C:\Users\user\AppData\Local\Temp\u224.1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\UIlweOQ5afwPPuh3ds8U6N2a.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\N96vu2CQjxii1alDjKixgxro.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\remGzM3ucI0rwNvHqGHEYSnk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\N9QaRzQ0AfOLtw4JsIq3BGlx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Obg7n5Z5efoxTsQrcye3Rd29.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\iiOuEJn1yBaeJOKc16avXLXi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\SuRnIHuWYWEWXFXLcVP2Or9Q.exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	File created: C:\Users\user\AppData\Local\Temp\u63s.0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\PMy8rA40PiG6kLCCQ4O29elX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\vRRDKxJPSQaL9EAwTnxxq5Xp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Z53Wf0X0IoS1KV8zvVeoh9Jq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\m17a3Wi6OxEiO5FsOjI20tNz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\aTkqzhHOj7NgaroFiyZu2tdl.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\tk993DcPKxGC0yxEJOpWA4Uq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\a84xxA52gOFQbQH4hbzYi5Xz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\YFF0xQcRAUpBPwLPUp2RM5MU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\lIVrBSt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\cvz8uTBLcjJDrWiUkH9ou3st.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\bLSHn6d_smbEd3DDHsdhdb9F.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\C3zBXysGYP5W2fmci6hd0XEB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\si8fAgQZyD6Cx4plDNMQadak.exe	Jump to dropped file
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036226544476.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\CertEnrollCtrl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	Jump to dropped file
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036016968100.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\kuRSiZPmKhbW1guMqYXCvrAu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\OzuxsP18idUhxNQxYYbIiZFx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\jPR83WX1aF07mPj541WJbft7.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\JN1IXYA8ssOWcLaqrtfgX1Ue.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\puSUyQPbhGQYc8ea6l8rcmDp.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\YEB6goJ_QRA9Ek_PBrASrKDk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\rqCKBzP3c5cie0ECqyDcHMBo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\0oplAGcqdSD8dY40aY8KDRaa.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\S8ELmP46wfy25sPQImx4dfKP.exe	Jump to dropped file
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\xMynrpRscnCMe5EhOaqNgT9P.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\5QOOoyFK4iimcVizzTfwyofF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\z2yKWzT0GXgmaQHim8qSwTt8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\LLoAVhqqC3TlPmj3xeFbhIJr.exe	Jump to dropped file
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036337438040.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\kTljKlVr9ONLnjGfMDuDLqq7.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BackgroundTransferHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\setup[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\WIPtBriceCKAWgIcBS0bein0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Pn5ZHf0b4pBQKwEbywjz1WNa.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\ws45TNfHbiigh1rlfu2kvwqp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036333922764.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\zMgiNzEE9vHMTa7pUx4El30p.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\u7khEnv04mT2EDLzgGnRMGoz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\gtrlRL8HQLBmCrpj7eGii9RV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\qWJzemjmehRTjWu4hQlmexeK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\dIzcszODhP85SLHp5gDwads1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\xFUB9mqMmDXHB6bYEudfe3bz.exe	Jump to dropped file
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143665496.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Tp59u6n2uhrgw2uPRJT1mo4o.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\exiuFZUeNjcDMo0MgYdiT1SB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Jump to dropped file
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036199797216.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\kzh8LUeSpUUvzS6kGzWDItYc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BdeUISrv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\UZEIOb5AJt4PKuFpMNcUE5kB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\rgIKhNst6KD41QCemJfU8B6e.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\mglK9j1udRLIlNMmqHDs89S5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\QULdLniTDqWIS6ivnfEkWMUZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\mrFftTFMgiVG2LP46B9gKHBo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\s9S2YPHvXa7oseKyop7fDJGM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\NOigbqKnljqgR3qaRHEw5cN9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\csCwmOCWNE9UELQ4txTVhw4w.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\4zJ5E9cuigEXwPfwJBBf2Voo.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File created: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\x6grxPSTyIeA8EPDMgptrwYO.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\setup294[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\71be4917[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	File created: C:\Users\user\AppData\Local\Temp\u63s.1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\zfmWdTyj1A0x7CDHTSCFc6P6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\UEaGlypujmRvmbw2BfkfATn6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_109.0.5097.45_Autoupdate_x64[2].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\dYzlQyYiVhnqA3GhRDFvHDg1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	Jump to dropped file
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	File created: C:\Users\user\AppData\Local\Temp\u63c.0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\IpPaPlW8SuKj6HZ6PbpzdKUK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\KlC0MO7JlENai4lmIm0fgxCd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\i3cGHUfhs02OIuQ54eKiruit.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\q1Wrkjlqz870PPzT0bIAuAXE.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\8lBOtksKAFB83rUCOP3QmQ2e.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\Documents\SimpleAdobe\poDcVPAkLsUtWqX_rqUuGuhg.exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	File created: C:\Users\user\AppData\Local\Temp\serversystemNCQ_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Sj3OVhjmKPY77wuH4sHs0IWD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Jump to dropped file
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	File created: C:\Users\user\AppData\Local\Temp\u224.0.exe	Jump to dropped file

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023618399.log
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023635601.log
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023630151.log
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240418023639593.log

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2ym1d1xnPNMzk5jErdF6V6UG.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YGFaax4VREMAQhHWBVtU9ND.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3PIKZrWnwy05CxuZRskqCwfF.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MygBvANjLf1AX31Xj7nu95Ot.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jC9hytOXxSJLUIWk7OLwYELs.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DJgk52sDeczUV1lmMmKix3k6.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m35TgMK4wpj8LJ6jgGf2Xw2Z.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kt7mfV03aeWQu4bZPgZ3e2n8.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tlcr68YHXdDJjhyT7wrqm3xM.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AN1sPJSyeZAaO0fgnCn2d82e.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\k2JDJYYF97BxDjJvdjfGyjtZ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J4OoATuxVsfOKcXUcxOLtc1U.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3oAYVErrIRWXBbeGz7YmX13.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\boo8FP0AhS3bBXLUBRbBJy9i.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHd1pNJmpFoM8sqoNNUE4tf3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kubdYrhB0F7KtjUXb85yOtnD.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oihjzJdDB6SwjKqgn4xLpgF2.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7wRR3Sd9ebwAodEDhY9Igh21.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqngqO4IdouWvJHIpDnLTPg5.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qbfh1kEfJzQeidHl0GsAyFET.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NZRD5waRyhBspSGbBIm0gdm3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bnux0XctxY2jUEcQFRrG9ED3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0L0N3gvArkRU6k774A53L7pm.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ft6HRmD3ARCfJ7A7sFRbGBMr.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZVwZaD0pkoPBTQLpyiUwKvm0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f4biQVfkFFQ1vVSgVTRMMCQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tAZVngHhHPzgcFHrRcS9MvT2.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5DvsXqu7rhEgw2bNo52xP7fS.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moQfGiqyu6YwVfcrFdZJ5YnD.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\alXN5bQawMu1k2uk8dHN6LdQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PnT9ZbC86TXnf3ynIc9924V5.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J7M1nQjDGRXKMq0AgiKFOvO.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x3w25VIhwwar8kgq72wIQMdT.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XFHdSFO3188VoWv0QrQcEWtV.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ikx69mladtPGsRKabYNZ6t0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vr4X7SKAWv4hdQph3V65g9Ue.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INrPttZcYp1b1IDxmBdj2E7I.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cioAsxrEgULT6QllewrDjFdd.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\olGMw8ij2FLh3ZKyyQztgUiZ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W8THWYViNOUp58e0uu5wCwhd.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CVcuVNYe8YDJ4yNu7pIFMe6h.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MnlURaBerk6x1crCbiGPEJWc.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4LIdC6j8pRS1z7WNkoaxi5da.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EXyR1877y9OTHbL7SmwL0Njx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fCajoF0uziKOHWOtsMKiSmkf.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iV9J0aMa18AmH41d2KxPgrGa.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lnqdr1oc3vWZb0AM6GqrJePb.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcYm79bKwGS9urVVZVjxlnOT.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2otv6cqxQYf5tfWSc9JYFFI.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42AtahIwsAQ9MCwYdGXiMWgl.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YeU8iF6BbqbTpHWTeh39oBMV.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NgmAydJthTuDbZVpKKk96QRy.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e9YTeMdvgg279TXXoNtMM7p.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkqRrg5iWYbcd6JdFTMqN4du.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lvJmufARuJlw0oQi9mXpQ9k4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CqLkLJsKMzyqpGaqpdD80xX4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uSsGDdtTis23IdAFsKMDjhvK.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9Xgc4e7oTv5WiPHkhGWgsF6U.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4Y9Dve63bMlMJwgLFapHtux4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0syZq7EY0CFhtffF1dHMEDe0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pPDwres8UiyP6hmT2n6yLn7l.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsK1YQ9kvBcxOEKHHnifbuin.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I9qlxtKCRbJZBgSVyvQk4qck.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wgrTK4F9BP7bp4UxruSjPthW.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aCZd0jUEZLTcGXCh2D1mXI8Y.bat	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat

Jump to behavior

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DJgk52sDeczUV1lmMmKix3k6.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3oAYVErrIRWXBbeGz7YmX13.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\boo8FP0AhS3bBXLUBRbBJy9i.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHd1pNJmpFoM8sqoNNUE4tf3.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NZRD5waRyhBspSGbBIm0gdm3.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bnux0XctxY2jUEcQFRrG9ED3.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tAZVngHhHPzgcFHrRcS9MvT2.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5DvsXqu7rhEgw2bNo52xP7fS.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moQfGiqyu6YwVfcrFdZJ5YnD.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\alXN5bQawMu1k2uk8dHN6LdQ.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INrPttZcYp1b1IDxmBdj2E7I.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cioAsxrEgULT6QllewrDjFdd.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CVcuVNYe8YDJ4yNu7pIFMe6h.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MnlURaBerk6x1crCbiGPEJWc.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4LIdC6j8pRS1z7WNkoaxi5da.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EXyR1877y9OTHbL7SmwL0Njx.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fCajoF0uziKOHWOtsMKiSmkf.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcYm79bKwGS9urVVZVjxlnOT.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2otv6cqxQYf5tfWSc9JYFFI.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42AtahIwsAQ9MCwYdGXiMWgl.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkqRrg5iWYbcd6JdFTMqN4du.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsK1YQ9kvBcxOEKHHnifbuin.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aCZd0jUEZLTcGXCh2D1mXI8Y.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YGFaax4VREMAQhHWBVtU9ND.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jC9hytOXxSJLUIWk7OLwYELs.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kt7mfV03aeWQu4bZPgZ3e2n8.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\k2JDJYYF97BxDjJvdjfGyjtZ.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J4OoATuxVsfOKcXUcxOLtc1U.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oihjzJdDB6SwjKqgn4xLpgF2.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqngqO4IdouWvJHIpDnLTPg5.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ft6HRmD3ARCfJ7A7sFRbGBMr.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PnT9ZbC86TXnf3ynIc9924V5.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x3w25VIhwwar8kgq72wIQMdT.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ikx69mladtPGsRKabYNZ6t0.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lnqdr1oc3vWZb0AM6GqrJePb.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iV9J0aMa18AmH41d2KxPgrGa.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YeU8iF6BbqbTpHWTeh39oBMV.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e9YTeMdvgg279TXXoNtMM7p.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NgmAydJthTuDbZVpKKk96QRy.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lvJmufARuJlw0oQi9mXpQ9k4.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CqLkLJsKMzyqpGaqpdD80xX4.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uSsGDdtTis23IdAFsKMDjhvK.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9Xgc4e7oTv5WiPHkhGWgsF6U.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4Y9Dve63bMlMJwgLFapHtux4.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0syZq7EY0CFhtffF1dHMEDe0.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wgrTK4F9BP7bp4UxruSjPthW.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pPDwres8UiyP6hmT2n6yLn7l.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I9qlxtKCRbJZBgSVyvQk4qck.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2ym1d1xnPNMzk5jErdF6V6UG.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3PIKZrWnwy05CxuZRskqCwfF.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MygBvANjLf1AX31Xj7nu95Ot.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m35TgMK4wpj8LJ6jgGf2Xw2Z.bat	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_00408761 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00408761

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe PID: 7412, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIES

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory allocated: 1E7B5FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory allocated: 1E7CFCD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 34A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 7190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 8190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 82F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 92F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 96F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 96F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: AA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: BA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: CA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: DA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 7ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: A7F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: B7F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: DFA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: EFA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 10560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 11560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 12560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 13560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: A7F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 100A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 120A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599716	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599049	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598698	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598260	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598152	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598021	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596848	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596723	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596292	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595949	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595575	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595416	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594819	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593736	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590785	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590353	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 585734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 585187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573055	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 567634	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 567172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 566297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 565531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 565281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 563750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562130	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 561312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 560344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 559250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 557281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 556390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 549500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 533031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 515039	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512910	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511276	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507135	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503549	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501556	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 498559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 497090	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 495347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 493777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 491570	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 489150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 487134	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 484379	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 481324	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 478850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Thread delayed: delay time: 300000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6019	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 3588	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 2104	Jump to behavior
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Window / User API: threadDelayed 1252

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_8-38755

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143868168.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\puSUyQPbhGQYc8ea6l8rcmDp.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\YEB6goJ_QRA9Ek_PBrASrKDk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\jQql7MG2XChbxjQ6gNLJX8a8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\KAKoKagL31aeT9tvPuu3L1bc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\ySa0tmdKXLMzZNFqxzPk3yl0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\31Q0tfhZ3ZbBeSnpH53Q6cmR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\LLoAVhqqC3TlPmj3xeFbhIJr.exe	Jump to dropped file
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036337438040.dll	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BackgroundTransferHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\BScYPWRXjjJsm0UZKd8ZE404.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036248045740.dll	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\e5ADH4rW9PcD5gtgsREzjuVn.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036332806404.dll	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036333922764.dll	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Extension__Installer[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\JeZCwGu4yuVGGxFvnw3BIkJ1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\N3dNHH1i3277Gfb9sVdhVcr5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\qWJzemjmehRTjWu4hQlmexeK.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\xFUB9mqMmDXHB6bYEudfe3bz.exe	Jump to dropped file
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143665496.dll	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\browserexport.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\BuKYLuXtWRFvMUw4E6QMnePB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\060[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036199797216.dll	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BdeUISrv.exe	Jump to dropped file
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u224.1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\mglK9j1udRLIlNMmqHDs89S5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\s9S2YPHvXa7oseKyop7fDJGM.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\AppVShNotify.exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u63s.0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\PMy8rA40PiG6kLCCQ4O29elX.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\setup294[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\m17a3Wi6OxEiO5FsOjI20tNz.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\tk993DcPKxGC0yxEJOpWA4Uq.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\71be4917[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u63s.1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\UEaGlypujmRvmbw2BfkfATn6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\zfmWdTyj1A0x7CDHTSCFc6P6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_109.0.5097.45_Autoupdate_x64[2].exe	Jump to dropped file
Source: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u63c.0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\bLSHn6d_smbEd3DDHsdhdb9F.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\i3cGHUfhs02OIuQ54eKiruit.exe	Jump to dropped file
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036226544476.dll	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\poDcVPAkLsUtWqX_rqUuGuhg.exe	Jump to dropped file
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\CertEnrollCtrl.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\8lBOtksKAFB83rUCOP3QmQ2e.exe	Jump to dropped file
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\serversystemNCQ_x64.exe	Jump to dropped file
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u224.0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036016968100.dll	Jump to dropped file

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_14-13856

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	API coverage: 8.3 %
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	API coverage: 4.2 %
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	API coverage: 1.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7824	Thread sleep count: 3588 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599871s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7824	Thread sleep count: 2104 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599716s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599608s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -599049s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598810s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598698s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598260s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598152s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -598021s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -597866s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -597477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596848s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596723s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596292s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595949s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595575s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595416s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595192s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7524	Thread sleep time: -2100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -594819s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -594515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -594172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -593890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -593736s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -593453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -593140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -592797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -592624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -592156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -591905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -591625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -591390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -591062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -590785s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -590576s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -590353s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -589969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -589594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -589375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -589078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -588750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -588500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -585734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -585187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -584750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -584422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -584062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -583778s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -583297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -583047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -582625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -582309s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -581812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -581187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -580578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -580187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -579687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -579422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -578875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -578469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -578109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -577738s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -577328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -576937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -576406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -575875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -575375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -574984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -574422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -574047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -573328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -573055s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -572359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -571828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -571140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -567634s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -567172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -566297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -565531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -565281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -564906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -564562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -563750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -562687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -562130s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -561312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -560344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -559250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -558031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -557281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -556390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -554812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -553578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -552625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -549500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -548219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -546844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -545390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -544687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -543422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -541500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -540578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -539375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -538347s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -536547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -535062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -533031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -531437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -530000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -528469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -527078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -525547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -524265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -522844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -521156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -519297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -515039s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -512910s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -511276s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -508856s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -507135s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -505282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -503549s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -501556s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -498559s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -497090s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -495347s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -493777s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -491570s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -489150s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -487134s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -484379s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -481324s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -478850s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe TID: 8128	Thread sleep count: 128 > 30
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe TID: 5308	Thread sleep count: 1252 > 30
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe TID: 5308	Thread sleep time: -250400s >= -30000s
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe TID: 8128	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe TID: 5144	Thread sleep time: -600000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Last function: Thread delayed

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_0040553A FindFirstFileA,		22_2_0040553A
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		22_2_004055DE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599716	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599049	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598698	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598260	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598152	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598021	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596848	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596723	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596292	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595949	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595575	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595416	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594819	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593736	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590785	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590353	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 585734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 585187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 584062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573055	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 567634	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 567172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 566297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 565531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 565281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 563750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562130	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 561312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 560344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 559250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 557281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 556390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 549500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 533031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 515039	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512910	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511276	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507135	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503549	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501556	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 498559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 497090	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 495347	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 493777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 491570	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 489150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 487134	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 484379	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 481324	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 478850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	Thread delayed: delay time: 300000

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	File opened: C:\Users\user\

Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: sbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--P
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Datacenter without Hyper-V Core
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: psapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= p
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004AA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: STAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00 %+v m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3ca
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie$WINDIR% CPU (%03d %s%v: %#x, goid=, j0 = -nologo/delete19531252.5.4.32.5.
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: ameNewaPINGPOSTPathQEMUROOTH
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: ersexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindo
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWARE_VIRTUAL
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: 11VBoxSFWINDIRWD
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000002.3342119410.0000000004A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: LycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd acceptactivechan<-closedcookiedirectdo
Source: CasPol.exe, 00000003.00000002.3380210528.0000000001344000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: aryvmcixn-SR-%W
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: main.isRunningInsideVMWare
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: rSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: 4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ... MB, \" and got= max
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3345349148.00000000004C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Datacenter without Hyper-V Full
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: tVMSrvcs\|!
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Enterprise without Hyper-V Full
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: 3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: yreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdo
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMU_HARDU
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Standard without Hyper-V Full
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthorities
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Enterprise without Hyper-V Core
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: vmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ... exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC
Source: JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: eUnprocessable EntityWinmonProcessMonitor\\.\pipe\VBoxTrayIPC^.*\._Ctype_uint8_t$asn1: syntax error: assigned stream ID 0bad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpcertificate requiredchan send (nil chan)close of nil channe
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: potency-Key\System32\drivers\\.\VBoxMiniRdrDN os/exec.Command(^.*\._Ctype_char$bad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcpu name is emptycreate window: %wdecode server: %wdecryption faileddownload fi
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: JIsbjewlnghreiCB15kllzTk.exe	Binary or memory string: releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \\.\HGFS`
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: lUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Window
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: PalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:
Source: QHuPF3k4no0JL9DdGqDYtkCG.exe, 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: vmhgfsP
Source: SU1be6oqYDorLkUc1l6IPPFB.exe, 00000017.00000002.3389956114.0000000002FE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe, 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: ultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-languageadvertise erroragent is closedapplication/pdfasyncpreemptoffbad certificatebad trailer keybefore EfiGuardclass registredclient finishedcouldn't set AVcouldn't set sbdecode hash: %wdo
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Standard without Hyper-V Core
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: swsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAccepted
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservi
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: ddrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.)
Source: Yz2gr4IqEnTCH1g642bo4hrO.exe	Binary or memory string: rayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\Def

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00409A73

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe

Code function: 14_2_6B906BE0 LoadLibraryW,GetProcAddress,

14_2_6B906BE0

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_004139E7 mov eax, dword ptr fs:[00000030h]	8_2_004139E7
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_02F1F06B push dword ptr fs:[00000030h]	8_2_02F1F06B
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049B3C4E mov eax, dword ptr fs:[00000030h]	8_2_049B3C4E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A0D90 mov eax, dword ptr fs:[00000030h]	8_2_049A0D90
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A092B mov eax, dword ptr fs:[00000030h]	8_2_049A092B
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_004139E7 mov eax, dword ptr fs:[00000030h]	15_2_004139E7
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED092B mov eax, dword ptr fs:[00000030h]	15_2_02ED092B
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EE3C4E mov eax, dword ptr fs:[00000030h]	15_2_02EE3C4E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED0D90 mov eax, dword ptr fs:[00000030h]	15_2_02ED0D90
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02FAEE93 push dword ptr fs:[00000030h]	15_2_02FAEE93

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_00420AEA GetProcessHeap,

8_2_00420AEA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00409A73
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00409C06 SetUnhandledExceptionFilter,	8_2_00409C06
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_00409EBE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00409EBE
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_0041073B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0041073B
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A9CDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_049A9CDA
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049A9E6D SetUnhandledExceptionFilter,	8_2_049A9E6D
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049B09A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_049B09A2
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: 8_2_049AA125 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_049AA125
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9A4218 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_6B9A4218
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: 14_2_6B9B6C84 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6B9B6C84
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00409A73
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00409C06 SetUnhandledExceptionFilter,	15_2_00409C06
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_00409EBE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00409EBE
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_0041073B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0041073B
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EE09A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_02EE09A2
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02EDA125 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_02EDA125
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED9E6D SetUnhandledExceptionFilter,	15_2_02ED9E6D
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: 15_2_02ED9CDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_02ED9CDA
Source: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe	Code function: 16_2_00408F71 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00408F71
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_0041584A SetUnhandledExceptionFilter,	22_2_0041584A
Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe	Code function: 22_2_0041585C SetUnhandledExceptionFilter,	22_2_0041585C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 protect: page execute and read and write

Jump to behavior

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB558C1
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79D398F28
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7896FC57D
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79D0F8590
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FFC23D
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FC05F0
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF78970E07F
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBF8E07F
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FD0A0A
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7892C686E
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CF6686E
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB8E17D
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A13E78C2
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF78930C23D
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CFAE17D
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CFE7174
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7893504B0
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBF7F689
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CFAC23D
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBF778C2
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FB686E
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF789347174
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF78932C134
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBCD8590
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A13EC57D
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7892D05F0
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB57E47
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF789709CB4
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A13F9CB4
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7893E6A11
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FC58C1
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CF705F0
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7896F8F28
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBF78F28
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79D39C57D
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF7892E0A0A
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CF80A0A
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79D089BDF
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A102F343
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A0FC4E7C
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CF8090D
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A103B123
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CFE3EA8
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A13FE07F
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB60A0A
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A1037174
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBBAC134
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79D3AE07F
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	NtProtectVirtualMemory: Direct from: 0x7FF79CF649A6
Source: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe	NtProtectVirtualMemory: Direct from: 0x7FF6A10404B0
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF789343EA8
Source: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe	NtProtectVirtualMemory: Direct from: 0x7FF789312DC6
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB505F0
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBBC3EA8
Source: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe	NtProtectVirtualMemory: Direct from: 0x7FF7EBB92DC6

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 404000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 406000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F8E008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe "C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe "C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe "C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe "C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe "C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe "C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe "C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe "C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe "C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe "C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe "C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe "C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe "C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe "C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe "C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe "C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe "C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe "C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe "C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe "C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe" --silent --allusers=0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe "C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7412 -s 1156
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe "C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe"
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8
Source: C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe	Process created: unknown unknown

Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe c:\users\user\pictures\t2riu3fph6dczigtg32vuvve.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe c:\users\user\pictures\sylcqzgphhuj3m0wbg0xxqzf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe c:\users\user\pictures\0xytwvhs3we9jtguurid6gip.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Process created: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe c:\users\user\pictures\t2riu3fph6dczigtg32vuvve.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Source: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe	Process created: C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe c:\users\user\pictures\sylcqzgphhuj3m0wbg0xxqzf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Source: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe	Process created: C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe c:\users\user\pictures\0xytwvhs3we9jtguurid6gip.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8

Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: k..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWnd
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SVWU
Source: JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32S

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_00409D1B cpuid

8_2_00409D1B

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0042086B
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_004170F1
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_004201F6
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_004201AB
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_00420291
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_0042031E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_004174E4
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_0042056E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00420697
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_0041FF33
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_0042079E
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_049C04F8
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_049C0412
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_049C045D
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_049C07D5
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_049C07D3
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_049B774B
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_049C08FE
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_049C019A
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_049C0AD2
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: GetLocaleInfoW,	8_2_049C0A05
Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe	Code function: EnumSystemLocalesW,	8_2_049B7358
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_6B9C83B7
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: EnumSystemLocalesW,	14_2_6B9C43ED
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,	14_2_6B9C8310
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_6B9C7F30
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: EnumSystemLocalesW,	14_2_6B9C7E88
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,	14_2_6B9C3EAC
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: EnumSystemLocalesW,	14_2_6B9C82C5
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: EnumSystemLocalesW,	14_2_6B9C8183
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,	14_2_6B9C81F0
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetLocaleInfoW,	14_2_6B9C84BD
Source: C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_6B9C7C37
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_0042086B
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_004170F1
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_004201F6
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_004201AB
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_00420291
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_0042031E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_004174E4
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_0042056E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_00420697
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_0041FF33
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_0042079E
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_02EF0AD2
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_02EF0A05
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_02EE7358
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_02EF08FE
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_02EF019A
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_02EF07D5
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_02EF07D3
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: GetLocaleInfoW,	15_2_02EE774B
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_02EF04F8
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_02EF045D
Source: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe	Code function: EnumSystemLocalesW,	15_2_02EF0412

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Code function: 8_2_0040996D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_0040996D

Source: C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe

Code function: 22_2_00414B04 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

22_2_00414B04

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C2D6C799-1878-4A10-AE0B-BB0304219A47}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Disables UAC (registry)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Glupteba

Source: Yara match	File source: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data

Remote Access Functionality

Yara detected Glupteba

Source: Yara match	File source: 24.2.Vh2fqCjm9jPtwuJrcfbbwxLj.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Yz2gr4IqEnTCH1g642bo4hrO.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.JIsbjewlnghreiCB15kllzTk.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JIsbjewlnghreiCB15kllzTk.exe PID: 7992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yz2gr4IqEnTCH1g642bo4hrO.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vh2fqCjm9jPtwuJrcfbbwxLj.exe PID: 7660, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	2 Windows Management Instrumentation	11 Scripting	1 Abuse Elevation Control Mechanism	71 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Windows Service	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	Security Account Manager	45 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	13 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	NTDS	261 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	3 Software Packing	LSA Secrets	61 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	61 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	24%	ReversingLabs	Win64.Trojan.Operaloader
SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	100%	Avira	HEUR/AGEN.1310450
C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\setup294[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe	44%	Virustotal		Browse
C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe	61%	ReversingLabs	Win64.Trojan.Operaloader
C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe	52%	Virustotal		Browse
C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	48%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	47%	Virustotal		Browse

Name	Source	Malicious
https://vk.com/Nuq	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.66.10/download/th/retail.phpsJ(	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	false
https://meet.crazyfigs.top/style/060.exeV	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	false
https://legal.opera.com/terms	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://sun6-21.userapi.com/c236331/u5294803/docs/d24/3cad94b79c70/imgdrive_2_1.bmp?extra=KSt_51f-h8	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E8A000.00000004.00000020.00020000.00000000.sdmp	false
https://carthewasher.net/bfdb39976dca392638e6450f1175fa96/cad54ba5b01423b1af8ec10ab5719d97.exe	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E64000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E64000.00000004.00000020.00020000.00000000.sdmp	false
https://help.opera.com/latest/	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://vk.com:80/doc5294803_668661395?hash=uQQoAVY7lWMuchlYkCFbK0P2SVazuAiimzHIh07ASrs&dl=WO5eZhu0J	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	false
https://policies.google.com/terms;	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://papi.vk.com/pushsse/ruim	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://baldurgatez.com/	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	false
http://www.indyproject.org/	JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	false
https://meet.crazyfigs.top/style/060.exeb	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2152191829.000001C315F49000.00000004.00000020.00020000.00000000.sdmp	false
https://yip.su/redirect-	CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	false
http://localhost:3001api/prefs/?product=$1&version=$2..	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://starsmm.org/om/525403/setup.exer-end-point:R	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	false
https://www.opera.com/download/	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://login.vk.com/?act=logout&hash=ff5c930db01817b629&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://meet.crazyfigs.top/:	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
https://www.instagram.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/common_web.4f7e5a9b.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/chunks/palette.434ea2ce.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
http://www.avantbrowser.com)MOT-V9mm/	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
https://st6-22.vk.com/dist/web/docs.20074c02.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/site_layout.f88780c8.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
https://turnitin.com/robot/crawlerinfo.html)cannot	JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false
http://www.exabot.com/go/robot)Opera/9.80	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
http://www.innosetup.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2151788726.000001C316035000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	false
https://starsmm.org:80/	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com/doc5294803_668661395?hash=uQQoAVY7lWMuchlYkCFbK0P2SVazuAiimzHIh07ASrs&dl=WO5eZhu0JdqJ	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179717574.000001C315E4A000.00000004.00000020.00020000.00000000.sdmp	false
https://crashstats-collector.opera.com/collector/submitNEB	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3387261111.000000004E454000.00000004.00001000.00020000.00000000.sdmp	false
https://gigachadfanclub.org/bfdb39976dca392638e6450f1175fa96/7725eaa6592c80f8124e769b4e8a07f7.exe4V	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp	false
https://iplogger.org/privacy/	CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	false
https://crashpad.chromium.org/	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://addons.opera.com/en/extensions/details/dify-cashback/	syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://autoupdate.geo.opera.com/geolocation/	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
http://www.google.com/bot.html)crypto/ecdh:	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
https://crashstats-collector.opera.com/collector/submit	syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3375978715.0000000001540000.00000004.00000020.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3411019967.0000000026E24000.00000004.00001000.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/page_layout.7b5800c2.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/polyfills.isolated.edaffb7b.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://opera.com/privacy	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
http://www.spidersoft.com)	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
https://sun6-21.userapi.com/c909328/u5294803/docs/d54/8868a626addc/files.bmp?extra=4Jh-lFC-FBDEqT-xO	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250448749.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com/0u0uDuw	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp	false
https://gamemaker.io)	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
http://https://_bad_pdb_file.pdb	JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, Vh2fqCjm9jPtwuJrcfbbwxLj.exe, 00000018.00000002.3312827601.0000000000ACD000.00000040.00000001.01000000.00000015.sdmp	false
https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315E6C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315E6A000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E6D000.00000004.00000020.00020000.00000000.sdmp	false
https://stats.vk-portal.net	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.65.64/download.php?pub=inte-J	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EBB000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/unauthorized.4bbc412d.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/css/al/fonts_utf.7fa94ada.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E69000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://r.mradx.net	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
http://www.google.com/feedfetcher.html)HKLM	JIsbjewlnghreiCB15kllzTk.exe, JIsbjewlnghreiCB15kllzTk.exe, 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Yz2gr4IqEnTCH1g642bo4hrO.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false
https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exeUniverse	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2162785597.000001C315F90000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/namehttps://ipgeolocation.io/status	3wiDjAuNAMEeKc2Sp8AJvkHN.exe, 00000012.00000002.1863098808.00007FF788E51000.00000002.00000001.01000000.00000010.sdmp	false
https://st6-22.vk.com/dist/web/unauthorized.20074c02.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://blockchain.infoindex	Yz2gr4IqEnTCH1g642bo4hrO.exe, 00000011.00000002.3312662666.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false
https://gamemaker.io/en/get.	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://gamemaker.io	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://meet.crazyfigs.top/style/060.exez	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2136505238.000001C315F49000.00000004.00000020.00020000.00000000.sdmp	false
https://jonathantwo.com	CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/raven_logger.ea0a2239.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://static.vk.me	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
http://www.alexa.com/help/webmasters;	JIsbjewlnghreiCB15kllzTk.exe, Yz2gr4IqEnTCH1g642bo4hrO.exe	false
https://st6-22.vk.com/dist/web/chunks/react.759f82b6.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://starsmm.org:80/Extension__Installer.exe	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/525403/setup.exe(	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2250598835.000001C31606B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2214896326.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2201459715.000001C315E57000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316079000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219601594.000001C316025000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216951657.000001C31608B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198566834.000001C316056000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C316055000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006751000.00000004.00000020.00020000.00000000.sdmp	false
https://crashpad.chromium.org/bug/new	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000C.00000002.3392234781.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000000.1726890164.0000000000FDA000.00000002.00000001.01000000.0000000A.sdmp, T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000002.3407084581.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000013.00000001.1826449150.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3322264502.00000000000CA000.00000002.00000001.01000000.00000012.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000001.2105606585.00000000000CA000.00000002.00000001.01000000.00000012.sdmp	false
https://iplogger.org/	CasPol.exe, 00000003.00000002.3402975175.00000000034DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.0000000003567000.00000004.00000800.00020000.00000000.sdmp	false
http://google.com	JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	false
https://carthewasher.net/	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/performance_observers.4d12f60f.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.ampproject.org	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.59/ISetup2.exe	CasPol.exe, 00000003.00000002.3402975175.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.3402975175.00000000034E0000.00000004.00000800.00020000.00000000.sdmp	false
https://management.core.usgovcloudapi.netGODEBUG	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2254455775.000001C31662F000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/css/al/vk_sans_display_faux.7d208ecb.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/likes.72a3dfff.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/525403/setup.exe	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	false
https://crashstats-collector.opera.com/collector/submit0x298	T2RIU3FpH6dczIGTG32vuvvE.exe, 0000000E.00000002.3379731294.000000004E424000.00000004.00001000.00020000.00000000.sdmp, syLcQZGPHHUJ3M0wbg0XxQZf.exe, 00000015.00000002.3411019967.0000000026E24000.00000004.00001000.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/chunks/vkui.bce4c996.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://triedchicken.net/B	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2123609804.000001C315EC3000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181878238.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2181344004.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2174393508.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179788596.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2182784722.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2179158263.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2184570072.000001C315EC9000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/jobs_devtools_notification.14f96f02.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.93b52d88.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx	JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, 00000008.00000003.2351558121.0000000006365000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/site_layout.20074c02.css	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.syndication.twimg.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.vk.com	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197680891.000001C316094000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com/browser_reports?de	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2241367516.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2215403785.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/error_monitoring_classic.isolated.99143b54.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://st6-22.vk.com/dist/web/grip.0b3b493f.js	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2195830948.000001C316201000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2219148573.000001C316001000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2196034426.000001C315FD6000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216913004.000001C31608C000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2224912742.000001C316273000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2216252408.000001C31608B000.00000004.00000020.00020000.00000000.sdmp	false
https://securepubads.g.doubleclick.net	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2240596988.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315E8B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315EA4000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2198735771.000001C315E6B000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2220046203.000001C315EA2000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2229181999.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2218205829.000001C315E89000.00000004.00000020.00020000.00000000.sdmp, KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2197888344.000001C315F71000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/525403/setup.exep	KI5P6OyhHMwNaNA4w0xtd3UY.exe, 0000000D.00000003.2164068721.000001C315F4A000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	false
34.117.186.192	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	false
37.221.125.202	unknown	Lithuania	62416	PTSERVIDORPT	false
193.233.132.175	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
176.97.76.106	unknown	United Kingdom	43658	INTRAFFIC-ASUA	false
37.228.108.133	unknown	Norway	39832	NO-OPERANO	false
37.228.108.132	unknown	Norway	39832	NO-OPERANO	false
185.172.128.59	unknown	Russian Federation	50916	NADYMSS-ASRU	false
172.67.161.113	unknown	United States	13335	CLOUDFLARENETUS	false
185.66.90.243	unknown	Ukraine	41820	NOVI-ASUA	false
172.67.132.113	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.169.146	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.79.77	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.31.124	unknown	United States	13335	CLOUDFLARENETUS	false
95.142.206.2	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.1	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
104.21.63.150	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.90.14	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.37.250	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.207.236	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.169.89	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.228	unknown	Russian Federation	50916	NADYMSS-ASRU	false
172.67.176.131	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.203	unknown	Russian Federation	50916	NADYMSS-ASRU	false
104.21.5.28	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.75.163	unknown	United States	13335	CLOUDFLARENETUS	false
93.186.225.194	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
20.189.173.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
5.42.65.64	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
172.67.19.24	unknown	United States	13335	CLOUDFLARENETUS	false
179.33.180.97	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
107.167.110.218	unknown	United States	21837	OPERASOFTWAREUS	false
104.21.91.214	unknown	United States	13335	CLOUDFLARENETUS	false
107.167.110.216	unknown	United States	21837	OPERASOFTWAREUS	false
5.42.64.17	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
107.167.110.211	unknown	United States	21837	OPERASOFTWAREUS	false
23.53.13.176	unknown	United States	20940	AKAMAI-ASN1EU	false
45.130.41.108	unknown	Russian Federation	198610	BEGET-ASRU	false
107.167.125.189	unknown	United States	21837	OPERASOFTWAREUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427735
Start date and time:	2024-04-18 02:35:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@132/280@0/41
EGA Information:	Successful, ratio: 45.5%
HCA Information:	Successful, ratio: 68% Number of executed functions: 117 Number of non-executed functions: 275
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe
Execution Graph export aborted for target CasPol.exe, PID 7520 because it is empty
Execution Graph export aborted for target JIsbjewlnghreiCB15kllzTk.exe, PID 7992 because there are no executed function
Execution Graph export aborted for target QHuPF3k4no0JL9DdGqDYtkCG.exe, PID 6480 because there are no executed function
Execution Graph export aborted for target T2RIU3FpH6dczIGTG32vuvvE.exe, PID 8100 because there are no executed function
Execution Graph export aborted for target syLcQZGPHHUJ3M0wbg0XxQZf.exe, PID 5496 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
01:36:02	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat
01:36:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\boo8FP0AhS3bBXLUBRbBJy9i.bat
01:36:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DJgk52sDeczUV1lmMmKix3k6.bat
01:37:34	Task Scheduler	Run new task: bWycNackLSywaqkmgR path: C:\Users\user\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\lIVrBSt.exe s>em /uIsite_idPNF 385118 /S
01:37:34	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat
01:38:31	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHd1pNJmpFoM8sqoNNUE4tf3.bat
01:38:34	Task Scheduler	Run new task: ImArchive path: C:\Users\user\AppData\Roaming\NBLwriter_test\TrueBurner.exe
01:38:34	Task Scheduler	Run new task: Mondemo_v5 path: C:\Users\user\AppData\Roaming\NBLwriter_test\TrueBurner.exe
01:39:02	Task Scheduler	Run new task: gTvwhQMzP path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
01:39:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3oAYVErrIRWXBbeGz7YmX13.bat
01:39:24	Task Scheduler	Run new task: BAnwxolbGpCzXNxkj path: C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\FbhVkaQ.exe s>XT /aesite_idfYr 385118 /S
02:35:57	API Interceptor	188x Sleep call for process: CasPol.exe modified
02:35:57	API Interceptor	35x Sleep call for process: powershell.exe modified
02:36:12	API Interceptor	1x Sleep call for process: WerFault.exe modified
02:37:16	API Interceptor	17x Sleep call for process: KI5P6OyhHMwNaNA4w0xtd3UY.exe modified
02:37:48	API Interceptor	1x Sleep call for process: 7ifrWkUACu1QmnINWqs0eu9h.exe modified
02:38:10	API Interceptor	1x Sleep call for process: JIsbjewlnghreiCB15kllzTk.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_72840a9326b146c8f797fe2c317b7fd81655ef_07b00b77_725b6b51-d5b5-4457-94a8-6a7675320663\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1971148951905926
Encrypted:	false
SSDEEP:	192:7Bj7/Wz50UnUVaWB2ASmQOAdzuiFEZ24lO8/Q:57/WOUnUVam2AZwzuiFEY4lO84
MD5:	B0A1F337D719D0B1EF81062DA79C22AC
SHA1:	254FE75E4FB216570E5AB18061F144B63F78196E
SHA-256:	8B8CABE55F274AA3ACBB43E02194CBE23C981B3FA6A8D8C5EC0E0D9B3E2B9458
SHA-512:	2CB6426FDBB457DBE3019169234D1F302772E05E94ECC84CD62E36175EAD088A6CFC78AD3FBAF0AB4CEA671F7B06D58396DBBD76754B354D4BB8EF9C45E12113
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.7.4.1.5.6.7.2.9.4.6.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.7.4.1.5.7.5.2.6.3.3.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.5.b.6.b.5.1.-.d.5.b.5.-.4.4.5.7.-.9.4.a.8.-.6.a.7.6.7.5.3.2.0.6.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.9.1.6.3.3.c.-.8.5.8.0.-.4.d.3.1.-.b.5.4.6.-.9.c.6.2.a.6.7.3.e.3.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.6.4...C.r.y.p.t.e.r.X.-.g.e.n...2.1.4.4...2.6.0.2.3...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.b.a.z.a.f.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.f.4.-.0.0.0.1.-.0.0.1.4.-.a.7.7.8.-.5.b.5.f.2.8.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.0.0.5.8.0.8.6.5.7.1.d.b.a.3.2.1.3.d.2.5.0.1.d.2.f.c.f.3.8.3.0.0.0.0.0.0.0.0.!.0.0.0.0.0.e.b.6.8.2.7.8.7.8.4.4.5.d.3.e.3.e.5.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12CF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7044387016978777
Encrypted:	false
SSDEEP:	96:TiZYWF+CG4YGYFb2HWYEZSV7tEii4HlnLwDyWvPYtua1LKMPbZIR6D:2ZDxhNqVv4ua1LKMPbGR6D
MD5:	BF830E6179C17B784BC50DCEF9EFF1B2
SHA1:	3DE44FAB32E336ACC0E7F3BC56A5CA87927E257B
SHA-256:	D6D6AFA275AD8BA5477B5DB77503E99B51B2E31E0E927A307F7376A61ABFF795
SHA-512:	C0A65868C0CAE392D3B92A858164478AD96BD91BB1E63CFD4603EF835E5910743F4C9893E75F18DD9A28749984C86F808A5A8F2E9F647E3E82935BFD41FDAF76
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F25.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	120190
Entropy (8bit):	3.1169973534153943
Encrypted:	false
SSDEEP:	3072:++TIedZ67afygI8z3A1fXqlENSipBpFhmaxF2Y7bRReHBZpdpDdtPW6DvwNGpX:l
MD5:	9F50FF9985C26C6C832E53F7D54F75DD
SHA1:	4CEBB67F2207FADEF07541D079D5CC09DD274234
SHA-256:	8B81DDCFA535CD124B9B47D5DE77738992B62EB274C209FDAC081425A8784DEC
SHA-512:	D8E8668CC1B53A5BEAAE17D67E86BC96E5BAF847D31854C998801266D1F6F6AABB293B48170BD7F03F64CB599D68FE9FB1A394F420EB559565FD84BBA87643A8
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41B2.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699942670375442
Encrypted:	false
SSDEEP:	96:TiZYWwxBf9XCXYZYLTQCHyYEZXYtEir4C04wtJyYSKUaqcLpMXbGIJ6c:2ZDcBWe1FkaxLpMXbBJ6c
MD5:	A04C946F05FF442FD135D8DBB03CFD73
SHA1:	7D7D834CA8B00FE216E5A85E79A6FC540DA0E6F5
SHA-256:	4C77A5899CA53D12E461476001357CEA2EB40A9930BA925D20110D87DBA2C94B
SHA-512:	C079B3A90777AFD26A4B689F6D533428D64A56E352A686CF4507C68B63E6479E413A68A3485A8D0F525B3E4DFDAFE1C460819DC1F97816CDCE61BE2A84319084
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD34A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Apr 18 00:35:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	513274
Entropy (8bit):	3.2285922156468136
Encrypted:	false
SSDEEP:	3072:nPA4dyZnfKZbI74J+pcSV8N01CCqEF06PGX3g6R3+vnL79jvOSxa:nY4dy5ZZlqNJQ6R3Q3Xa
MD5:	2F5952AF398883E97CFA3D5F1146FE89
SHA1:	F9E9F242F72FF94E8D05CC36D1E00F858580C443
SHA-256:	B8E1B3D60599C944E663D08386A68C899CC37D72AFD0201ECE03A69999C31D94
SHA-512:	A118C4D1FC52C9BB8CD5E5C6501FB4CAF005BE315C55791E5DF04C40B011533F14AB7ED43B556C684F9641A2EE0AF6D19738AE33B8F96F5C219A07C4AF32743C
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ........j f....................................$....%......t....%.......P..............l.......8...........T............9..B...........hD..........TF..............................................................................eJ.......F......Lw......................T............j f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD530.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8754
Entropy (8bit):	3.710779808502541
Encrypted:	false
SSDEEP:	192:R6l7wVeJMH66Y9EnyJgmfD6JVprp89b3VbfX9m:R6lXJ066YunEgmfDiO3JfQ
MD5:	3F19B1EC70A4EFD713D8FF89F8F20E10
SHA1:	AB89996A42EA07D6CDC91215FE0EB479503A9DBB
SHA-256:	748971A7C95616C06F6CC83BC3B41C7DE46BD7BA1061BA2C778621B78AC9FCC9
SHA-512:	F018BA328D058C56F10C47D35CA516AE7BF172FB364E6854E037991120EE347F0ECAD5731C885D48D886EBA7DCD2F10F3A14DE81E77CD5F5687C4E22054DBD10
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD58E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4943
Entropy (8bit):	4.588188452084952
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg771I9GpWpW8VYxYm8M4J58dAFEyq85dYGuBOU+hUud:uIjfRI7tY7VpJcouB7zud
MD5:	C75322B23837912243838BFCD1E74497
SHA1:	D0C9C9563A87DAE6F8B89ADB0747D20DA8582F85
SHA-256:	1E508F99C2C56DFA5319D3DBD2BCFF754F24783BE2CFF0AEAE538EC81026361D
SHA-512:	192B140BBE31129C30928CC581E79F1040C68423B3C2DF652F5BAB5CC8119100F81139F3FDBE5324A36CCF4D69AB755D8518FDB9F9A905375247670F5B81C0FB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="284618" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5AC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90244
Entropy (8bit):	3.1192825812958773
Encrypted:	false
SSDEEP:	1536:86xf0CIxxb8XfYSbO/mC0ifSwQtMm5yxZMy3UGH:86xf0CIxxb8XfYSbO/mC0ifSwQtMm5q1
MD5:	59AF6233BE521B6DB990365C84C679B5
SHA1:	8444685DA3636D9626099E315BCD695F39DD2C09
SHA-256:	809A5A2093A90602498FDDD4201225991DF5D50000739F8A35BE227943F51CC2
SHA-512:	E4798C869ECBA34D484ABCB4078847DADBDA8C7B5AE81E24DF717A6A9A0F12D3A65083277110589EDA263A5F8E1EF28120F67E619398B1A2062784BEFA8AF98D
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD61A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684170560943136
Encrypted:	false
SSDEEP:	96:TiZYWvp0uZ5yYDYLWCHAYEZq9tBiZ4q0KwM4CaOcLZMFkcIz63:2ZDTS0YGvaVLZMFkbz63
MD5:	E213244DD0D0DC35E082A963CEBCDDCC
SHA1:	F71F65F2148375354D35385D7944E80EBC95209D
SHA-256:	D3AE15B98F792548C294370338EF3F423D1486EAC17473655D20E519AB27CE9F
SHA-512:	2027A9E37D02D6BFA750FB02FAD750A376D8AF57BAB5B284EFF5B78EAE3B1A64A291C87F6F72871E4A0C74CC380F5406131632624863EE4BB5C8BF157D07186A
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF479.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	129264
Entropy (8bit):	3.1072467096356253
Encrypted:	false
SSDEEP:	3072:y3fqc/dI4PrF4MWvpQeM00LuP+PVXW6zVntysTP947UV8hCjpZCQJOxQQ55Vij:s
MD5:	EF1692FC004951E868382CD9A8271C40
SHA1:	123885DFAD3B35763DD8AF77C207A4F507FC47D0
SHA-256:	3CE91E92E951AFFF4621E9DB20A361AE0C7E1204923CDA370D7554CA5498D114
SHA-512:	DA06CA971929FF7A9F3210AD18FC62B71A35C3CA729ACE9099FBCFD4E9F2E5AEA0672AFDB8B7FDD530C0491F5D65B39823D81D93B180C6B1D851794DDF0829F4
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\31Q0tfhZ3ZbBeSnpH53Q6cmR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884127347307364
Encrypted:	false
SSDEEP:	98304:z0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwww1:IPMki6zio75L3pf3dedO4keCIwkoYbgV
MD5:	FAA5E9B03992A4E6148B799082100602
SHA1:	6A7F81280293B1EE54DFA9E4CDB187DE441A4897
SHA-256:	55067872C8F4490FBD427FBF6209B43E0F22A59AAF2A60F7733E2B1E51AFACB7
SHA-512:	E1671D70469A13216A4EAF36A3752B537A66515A67FFA5CAA4CCBB966F54F1227FAD52115C32C26400CC4C4FC0DDAB47802DA463FA8E70BF1C1BB3B99CB6EE1D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......\R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AO0lQiXja0SJ1xVYKQpJ0RgU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\BScYPWRXjjJsm0UZKd8ZE404.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126544344988
Encrypted:	false
SSDEEP:	98304:d0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwD:2PMki6zio75L3pf3dedO4keCIwkoYbgj
MD5:	69E1ABABF2EDDB10050CF8F77602BBE5
SHA1:	FD197C40FCDCB2585295FB1E1A3E7D81B04C65B1
SHA-256:	7F6DAE24C6A7439C6894CA16A7376D87DE4CB64BE83CDBBE24E78AC7B9F9D749
SHA-512:	42499B0E2E2BFAB62374142BC11A664B24ECC160D2980510B17123F139C8F91DE504F39BD80BB244EC0365A200D3FAFDCEBA0077A69D774EC7C4FAEC83A14236
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.....MHR...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 44%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EEmi2L6GuCPkhaixWFWgtXmC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 52%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\JN1IXYA8ssOWcLaqrtfgX1Ue.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884127351666352
Encrypted:	false
SSDEEP:	98304:J0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwo:aPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	CD54757EAFA70E59850F77982FAFCB49
SHA1:	C339E58CD44295099CFFD1AB783FCC65A5A9913F
SHA-256:	39D50F4716DAEF3C7B75E4DE57441390026036507E9B1676A927B85808BB526F
SHA-512:	94B24A1E28CD7FE880C2CA6AA21DEFD92CA2B6B5000208A5F8528E4DED777647616D44818C42257C8C6C5F2B95BDE8C484DFE8AF5DFC0DBB198958F93E7D6D33
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\JeZCwGu4yuVGGxFvnw3BIkJ1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126021626081
Encrypted:	false
SSDEEP:	98304:l0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwZ:+PMki6zio75L3pf3dedO4keCIwkoYbg5
MD5:	1560C8B87E585F41D68CB050AE0CF052
SHA1:	6919DDFE2A4475883092257E9B8B12DE0811D1FC
SHA-256:	D22C0AF0FC10A88FE2B59AE051951EB6DFF323D7A4C145C80AFCD69D9FD52A02
SHA-512:	5E645243F8E44E28CFF5113B683ED97713DCCB56A6DB1E8B13905FEE9007C76B177F607E0343C69B3D8FC0BD0899D8C515FC86E5EDB985159CC4A61BB56C1B13
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......HR...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\KV2qLRPax2onnz5Ndu1Z5G5q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884125378117049
Encrypted:	false
SSDEEP:	98304:/0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwy:MPMki6zio75L3pf3dedO4keCIwkoYbgS
MD5:	B1D3A17EDD5DACC6B98BEC740C1B4A2F
SHA1:	9E059C6CE6AC7E32D848B29026C34A5D0C1599F0
SHA-256:	92A81D1CF0DADC90DEA8BD297EAA153A755B3B972D77D141E39C03F76C2D8B28
SHA-512:	3F9914FE9C10AB719814BEC9625D2BF3F0A564F814FF6AFAC082BEB594D14831640BB2E59A3CA8B1E7F3E9AAB26AA4A416D25C11A752858202B02625995BD505
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......S...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\KWbVzicuAiSBYHryJZst17v9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Kocn1QGnt5lNON74XhjpO8L3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343552
Entropy (8bit):	6.7047176909836566
Encrypted:	false
SSDEEP:	3072:XRKcLCu7bjrfJE0OlCV0+L/h+nPO9lhE6Vh5MaYo8DU06kgTJW7E1LeUOUkEqiQJ:EEbj9ecVRL/hHVhVJ06fTJpfq0zxJL5
MD5:	540F70094794C16274ABCD644DFE7738
SHA1:	9C644CF30F5BB34E824E2C73A761AAE159900547
SHA-256:	0DDADD676CA7814044645E7E230F25A9E1BFEF479582179D22AB4A26F962B5D9
SHA-512:	20206DFA3F7D4A144B2158D2FFA7F101B95CEA396D377A4DACE47CB010C75B1F3E5FE79065A2B03DAAF4EB98EC43A01AF7A66E89A2D8170B1CB9970D17C675BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 48%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....T.e.............................g............@.......................... .............................................t(..d.... ..p........................... ...8...................h....... ...@............................................text.............................. ..`.rdata.............................@..@.data...H...@...&...&..............@....rsrc...p.... .......L..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\setup294[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2188562
Entropy (8bit):	7.94338433261686
Encrypted:	false
SSDEEP:	49152:CvxfXTFb1TJDfeQ3ZPSdivgGasStYLXbCKsVZ4:CvxBzfe6Kdi4GasoU2KCZ4
MD5:	309E2C38AED62655F7CF09CFCD40A56A
SHA1:	A235B5E71D665DDD520443DBA2FD42E0F89E3FDF
SHA-256:	0B9A3732229105BFCBFD661BAEC73D588F4FE63F1A8F5DE162607874737DC0D4
SHA-512:	642354A2A0A475AA979E44C00198761DB6E3C0C10075C8D4F44B6B1F43760C49784D9BB6ABCCAF18E0F7CE762CD931708AAD572C87EEDFB03E821749E46CC09C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......#.=lgwS?gwS?gwS?..?jwS?..?.wS?..?.wS?...?ewS?..W>twS?..P>qwS?..V>UwS?n..?lwS?n..?`wS?gwR?ovS?..V>AwS?..S>fwS?...?fwS?..Q>fwS?RichgwS?........................PE..L...`..e...............!.............m............@.......................................@.........................`:..4....:..P...............................d..@...T...........................@...@...............,....0.......................text.............................. ..`.rdata..............................@..@.data....\...P.......:..............@....didat..x............J..............@....rsrc................L..............@..@.reloc..d.......,...,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.544910731342647
Encrypted:	false
SSDEEP:	6144:JXkws5FHvbaXTLC42m+g51uHct7jGZyL:JUwsvbaXTLCfg514ct7aw
MD5:	867B7D371368F7872DA473E89646AA0B
SHA1:	632E18C92F4E304DFF18F8C6ACFE165D7F5F538C
SHA-256:	CA3CB9514C8544017CEF8E68C76D4ABBB7028019D2DB0C4AC4D88C29700743DC
SHA-512:	D5B492E5B15264F47F4C811BB0BC7584C3A914839A2D1EF962C217E6091203C72434EFB2D2100097A75B8BDAD007B1EC2A6849D51839BF1B23ECEB47802D1E86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 47%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L.....Ed.............................g............@..........................................................................(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data....x...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\PL_Clients[1].bmp

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	data
Category:	dropped
Size (bytes):	5077012
Entropy (8bit):	6.713227789841581
Encrypted:	false
SSDEEP:	49152:pVJXO9PUAjyyUWbeBV3XEWkMgv3KT0RJ3P23QM+IL6:pVJUPZjjUWbg3UYgv6SpP2gMC
MD5:	1047B1F6A74DA3574E0995A5A122489A
SHA1:	3E0A1BECFD48F15CE486E85B1D2F29D079388B43
SHA-256:	F8D58AFC94CE91D30BEC6308306132E23A888D0B6D95DB461E4D5F9F7DFBEB51
SHA-512:	55B8CF3817E86EB0665CFCB2C94F4A59CF1026DBA202D5644D2DE2E2685A8DEDE8CE51B07C822F3B76126B98FEFC4F0B2DEA4C0B548511DE2EFDB9CB008E7B36
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........gf...5...5...5..4...5...4a..5...4...5o7.5...5o7.4..5o7.4...5o7.4...5...4...5...5K..5^4.4..5^4.5...5...5...5^4.4...5G\|v}...5................EP..Y......s...............2...../......../.......................................I.....P.[.......................................1..........J....................I..............................E1.....................................................55555555.........y..................5..u55555555k............e..................55555555............g..................;gfgv....J.......u......................55555555......6..G.....................W;\|qtat........1......!U.................;ayf.........E1......#U.................;a}px\|qt..-..u1...-..-U.............u...;gpyzv........I......mX.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cad54ba5b01423b1af8ec10ab5719d97[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396432
Entropy (8bit):	7.971776651930106
Encrypted:	false
SSDEEP:	98304:CkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDK:zZ2x3CqNcHdGTLNp+F+8elDK
MD5:	B771700D69018054DD943B925FEA644C
SHA1:	4E2F78B445F72BA9047E1C3B04D3038F02EDBE44
SHA-256:	D17AD1DCBAFC3D794863720E3ADBB64FEC117549A51858DB3BE7B7B7F3BC63F9
SHA-512:	5FDE1B9785B13073394F355F627B28932AA436A50A9FC4B93C8F6E2E2BC92CBFA00479BA23339F67D7721BBFF5A0EDDFDCE471C00FD9BC6D6BB27E7E93AC4F32
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C............. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\crypted[1].bmp

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	data
Category:	dropped
Size (bytes):	334964
Entropy (8bit):	7.705017859990294
Encrypted:	false
SSDEEP:	6144:/gVZRnlVauSzupCXYHbqlK1CRdKKvTNyykMiMqMOMU2RKUDsbtv:/gPRDECpCXY7UKKvTNyykMix2cVR
MD5:	FCCE3C5D035DDB86B641DAD9E995A875
SHA1:	3D61D915A9B27D2BC086481995D48624E3CFF674
SHA-256:	F3F19E11D647C218078DC26444E72A3AA0F35D0AB27C9BBACA9214D45165EA6B
SHA-512:	9EBB3E40D8FEE928914155DF1ACFED421B7CA7D3320264F6B0CD4837C1ADA75C48354E5D5683BB08A2005C2CC12B42C7C16C2B225814E7EAD71829EBE572A52E
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........V.[.8.[.8.[.8...;.Q.8...=..8...<.O.8..1=.}.8..1<.I.8..1;.I.8...9.^.8.[.9...8..21.Z.8..2.Z.8..2:.Z.8.G\|v}[.8.........................EP..Y.....5s...............2.9..........v........................................%..............................................Q...).......................e3......5......................................................=...........................;apma...[?.......9..................5..u;gqtat...........y...%..................;qtat...Y[.......S......................;gfgv...................................;gpyzv..5..............................W............................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\files[1].bmp

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	data
Category:	dropped
Size (bytes):	4825092
Entropy (8bit):	7.3637959961825254
Encrypted:	false
SSDEEP:	98304:zrcM2qW+CtfomFAJPhD6yJic8zmzmRE3sahm:tZCY5DhJinzmmosaA
MD5:	C4F37EC04EECD2873018F55412B23348
SHA1:	4438C303C59C47B6064854B7D922E4998974FE00
SHA-256:	D0ADEAE76A52B284784DEC96E3195BA67D55F9070A855DE88E87F2E352BB6A76
SHA-512:	B5585462284F7F7A2E409E9FA4427ACD1374B3D74D6CC359A24B40B6EC7BFBB68E852344B4BDDB1091C5C4687928FE6905B838A8165EE5B4CF0A80E1DB5EEFDF
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y....#...............E..O]..Q......;m]..5....]......5........................_..............................................b].^.....].......................\......................................................5...............5..]...........;apma...!M]..5...O].................5..u;gfgv.........]..W...I].................;gpyzv........\.......\................W.................m].....]........e...........U...d..............................................#>.=.<y.=.U..?../>.=!.@..=....?.C>.=m@.\..=....-.....?..W>.=...)k.......?...#>.=^"DZk....?...%..........>.=..}F5........-........P........ ...3...-....f.........5.....,....35....-....?f.........-:...f.........5.....,....35....-....f.........-....f.........-........%..>.......>.=.. "-......?-....-.....k....z......-......%..>.......>.=\|2[w-......?.k....z......-....-....-......%..3.......>.=.I_+.k....z..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\setup[1].htm

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.301576517537887
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPzATV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPzuzlwAULma+
MD5:	9C979EB881F53B52060142DC127ACC6D
SHA1:	D77E0BEB384F45C7EF01FEF98F5DEBA0DEA07C15
SHA-256:	3FCBA2835E4E13EB1E0E71C8551655823D92BDCB3E446897CDC256B93F9ADCC3
SHA-512:	C45B0C8FAF43B6D01EFB4AEC9834146F72DA3D0AFC615CA7DB0DF3B651B68131A144674282D02155297D5A76FA7330217BF758535F785916C9F592C9170BC5C8
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://c.574859385.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\71be4917[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	318464
Entropy (8bit):	6.547791907799988
Encrypted:	false
SSDEEP:	3072:kpmcLlzbB0rV5n7CzvfHT99+nPGEl8G2TQVWyS7xAYjhMp70nFXXa6uF4W6vc2m:/qB0772v/T99oVmA370nFXKXF4W602
MD5:	919F8F761910803D4FDAB592DBBEE63C
SHA1:	819C861043EA6BA0D69D48A56E1F8A0C295EAF83
SHA-256:	FC1D13A97211887DFA7767DAA27817C1575834899D9F47A674F81D288230DF6E
SHA-512:	69E13430652A6855F9CFA4DF964F3BDEBADBFC8D405B06330706E7A273A5D06B34836864EDA4B792FA46EAEF1B7CED10F7C2E024C7F9E09B329938D511D481EE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....Z.c.............................g............@.........................................................................t(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data....\|...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\7725eaa6592c80f8124e769b4e8a07f7[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396424
Entropy (8bit):	7.971776907219028
Encrypted:	false
SSDEEP:	98304:6kZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDv:7Z2x3CqNcHdGTLNp+F+8elDv
MD5:	B8A886917F1F5AC4B6B6D85592BA5FAE
SHA1:	F79435A483AE68FBC7843F599721429B53D67C1E
SHA-256:	581D748ADD7C355C0B9A75A8E2FBBE1D9098562C57E05BDD2F30EC45AB5B5390
SHA-512:	7F37566F8DEDCBA66E12C012E082B4A7DF53D767F78525CFCE1C59067921B8ACB756C7496AE74F8B742393F0DBAB48E32E63A1F23621EAEFDA4EE331E1F1589A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C............. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Extension__Installer[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	303104
Entropy (8bit):	6.1282620196226825
Encrypted:	false
SSDEEP:	6144:5pUtp57JgcC9umP9mQwFpaSPBu+opYh/MLlRjdV55Y14PLckdK:Y7Ydfbe8uBuhpk/wd5HjVg
MD5:	3920320ABE977A8205C64894CA6C7E03
SHA1:	C7B79862B48101986F1CB72F4298055B4238C617
SHA-256:	95ABB1FF23E79D1CCB8A08F9802FD8D3358F2F7F6895494F06EAD92AE39AE0BA
SHA-512:	AACD03DB1EF36B6978632DC2E3E1F3A2DA82576C15750E8359238CB104333BE7F9D2C8B3D4A12BB2A8DDA1CD69C7F6149A77EC2C09197C219FF8B657DE72DD71
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....b..........."...0.................. .....@..... ....................................`...@......@............... ..............................................................<...8............................................................ ..H............text........ ...................... ..`.rsrc...............................@..@........................................H....... +...&...........Q..hd...........................................0...........(....&.s.......s......o....o.....+B.o.......o....(.......o....(....,...(....&+...(....(....&....(.....o....-....,..o .....,..o .....,..o ......(....".Np..........dz..........v........0..........(....(!...~....(......&......................("...V(#...r...p(............,...%.r...p.%.~....ri..p($....%.~....r...p($....%.r...p....,...%.~....r...p($....%.~....r...p($....%.r...p.%.r...p....,...%.~....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_109.0.5097.45_Autoupdate_x64[2].exe

Download File

Process:	C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108893416
Entropy (8bit):	7.999992755622592
Encrypted:	true
SSDEEP:	3145728:BBFS7Vpknp2sTT4bt+vy45oRmdfAKLlEPE:Bza6p2sT8btA59dd5EPE
MD5:	5014156E9FFBB75D1A8D5FC09FABDC42
SHA1:	6968D1B5CEC3039E53BBBEDEEE22E2D43D94C771
SHA-256:	7A01E11E1830BA3C154E5A6C383DA15938B1E48F89A2FE4045CDD260924B6802
SHA-512:	BFC5C44881D0FA7BCBCCFD530D874FA624ADEC50E1A16063A72DE12876D2DB10CA5EDD6FA841EA63E9DECA3FF2ADF54065F50719FE051D41DE92BB68EDBA4016
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................z~......................................b......................Hk}..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\060[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5132515
Entropy (8bit):	7.9989710005062715
Encrypted:	true
SSDEEP:	98304:edvpKKEk7iDhtjYagGe5e5Nbx0U9WNuKnLYUhymVb2:ihwYiDfjgQWFLphJC
MD5:	F7900D3A6E3F0A09BA62AC64B9290B34
SHA1:	A48992FBDA2A879AA3A03D2FB319D4975EDD218B
SHA-256:	8B0BB592AC99DC7FFBF70BFCFADABABB7BAD4E7AEFC8C8E965BFEE66ABDBC8AE
SHA-512:	134C9F8276B9D48FF0C174D61B3618D7E52852C6BC7AE08146B352E7476BCA0F5330BC712D89F207E2443A956C809FDAF46F390DDD1A5F8C2FCBA2670D445070
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B...................@..........................0...................@..............................B........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..B...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\crypted[1].bmp

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	data
Category:	dropped
Size (bytes):	427524
Entropy (8bit):	7.797596739400079
Encrypted:	false
SSDEEP:	12288:kUBwGC0lwC1CdJn7sUQGk1jCwiUlG9XdyQn3YgUxw8IyH:+GOoUQ/uy89XN3YgUaG
MD5:	6374B40C86981C6389B71F562D125E56
SHA1:	7EECB0D8AEB1D830C529A281BD2B6F0BB2D75437
SHA-256:	EFD92C46FAC78F6BEE40DFBB14EF3279AB7B0C5F7CB8AEAB4B2D87189A819B2D
SHA-512:	CF55FAB31F4976D528D68FA6822E94988A02C073A7536936757D7A242867A59AC6870C3E07697562063582AF4A4C4320B09AA0D446EE88A11244FBF16026BD20
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1............L..L..L...M..L...MI..L...M..L.,.M..L.,.M..L...M...L..L...L.,.M..L6/.M..L6/"L..L6/.M..LG\|v}..L................EP..Y....y.s...............2.%...I......r...........................................................................................)...................................e...................................................=...........................;apma...^;.......%..................5..u;gqtat..Sx.......{...!..................;qtat...................................;gfgv................g..................;gpyzv...............a.................W....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\imgdrive_2_1[1].bmp

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	data
Category:	dropped
Size (bytes):	6153220
Entropy (8bit):	6.377643292816472
Encrypted:	false
SSDEEP:	98304:MpfBkrNIUp96am5aY7LfSnlu0SBT113oufTkPH8BhwtAhWYxO703uw:MjmIU6SYV711ZTkEBhwwxO7Kuw
MD5:	7B284CFC3CDF77F706342B3286160AE4
SHA1:	33BA021D323680BECE781474CD2E36949D502DBF
SHA-256:	96C140DC6A89A13861DFFB8BCF7FF312AB521E31844800199A6F8B9686478B70
SHA-512:	539DBB8CD1FCF9983DCF28B7C12619BE83DA4C2CDAB74C30804C655D4E5577F5DC99B21277F3607A7D7D3D027C31BEE6446779A1AB77A9B5EA7EAA4F6298CA47
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.................;....1..3...H..............................................%q.....h.K...u...5......................................5w.[....%w......ew.R.....N..............Ev..............................9N.=...................i!w.............................;apma.....3.......3.................u.uu;qtat.........2.......3...............u.;gqtat....;...9...;..i9...............u.;eqtat........N......=N...............%.;mqtat..Q....%I.......I...............%.;wff..........I.......................u.;pqtat..[....5w.......I...............%.;\|qtat.......%w.......I...............%.;VGA....e....Ew......%I.................;ayf.........uw......'I.................;gfgv...R....ew......!I...............%.;gpyzv.......Ev.......H...............%W............................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\setup[1].exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6645997
Entropy (8bit):	7.9960820227785065
Encrypted:	true
SSDEEP:	98304:91Obp2zjJY231tFaCYTlZE1JLFSNGw6eJm5JeHxFKw7/X26jOnCB9XmtPtX4S8Bf:91OF2zjVpYD8vDwJmaHxbS2Os9qP0eEV
MD5:	8433EAED37248E24EB963A444E5E1EED
SHA1:	8D004418690587FC541547B2D0EFE2CFD629FBBA
SHA-256:	7B4A250930BECEDC17B8D67DFEB39EE143B03466E85D2D77282AA52014BCA196
SHA-512:	8656B020A34F6300F79675954DD56587E7678EC46DE92E53FC945E5FEFA476504761DB0FB0AD6F3C2C9F97D52CDD3767399EB8FC8655BCE5E77C40C1BE99BF56
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	unknown
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\N96vu2CQjxii1alDjKixgxro.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\N9QaRzQ0AfOLtw4JsIq3BGlx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\NOigbqKnljqgR3qaRHEw5cN9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Obg7n5Z5efoxTsQrcye3Rd29.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\OzuxsP18idUhxNQxYYbIiZFx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\QI8XvF6duFZ0OdsmbJPQIRnh.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\QULdLniTDqWIS6ivnfEkWMUZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\S8ELmP46wfy25sPQImx4dfKP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SuRnIHuWYWEWXFXLcVP2Or9Q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe

Download File

Process:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884127351666352
Encrypted:	false
SSDEEP:	98304:J0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwo:aPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	CD54757EAFA70E59850F77982FAFCB49
SHA1:	C339E58CD44295099CFFD1AB783FCC65A5A9913F
SHA-256:	39D50F4716DAEF3C7B75E4DE57441390026036507E9B1676A927B85808BB526F
SHA-512:	94B24A1E28CD7FE880C2CA6AA21DEFD92CA2B6B5000208A5F8528E4DED777647616D44818C42257C8C6C5F2B95BDE8C484DFE8AF5DFC0DBB198958F93E7D6D33
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe

Download File

Process:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126316660053
Encrypted:	false
SSDEEP:	98304:90NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwk:WPMki6zio75L3pf3dedO4keCIwkoYbgE
MD5:	EF199316DF30CB4E02F45F156EC63A9A
SHA1:	1D01117469FE286CE64CD27DFCBF939DFC7E8F22
SHA-256:	858F0951DC8F6A15014CE367AD4CD4274D93881AA5D0B101ED524389CD25BE3D
SHA-512:	F7BACAE2D24E570911358EDE0B56CC0A94713A1CEBC47BBCB9D83AAD3B357F7CFE5494C0CF5BB2972542F469B9538BAE0F9100C3BBA918DE71040E9FED8C5A9E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......\R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\kuRSiZPmKhbW1guMqYXCvrAu.exe

Download File

Process:	C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884125378117049
Encrypted:	false
SSDEEP:	98304:/0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwy:MPMki6zio75L3pf3dedO4keCIwkoYbgS
MD5:	B1D3A17EDD5DACC6B98BEC740C1B4A2F
SHA1:	9E059C6CE6AC7E32D848B29026C34A5D0C1599F0
SHA-256:	92A81D1CF0DADC90DEA8BD297EAA153A755B3B972D77D141E39C03F76C2D8B28
SHA-512:	3F9914FE9C10AB719814BEC9625D2BF3F0A564F814FF6AFAC082BEB594D14831640BB2E59A3CA8B1E7F3E9AAB26AA4A416D25C11A752858202B02625995BD505
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......S...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\syLcQZGPHHUJ3M0wbg0XxQZf.exe

Download File

Process:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884124407997752
Encrypted:	false
SSDEEP:	98304:k0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwww:lPMki6zio75L3pf3dedO4keCIwkoYbgQ
MD5:	C2F0D0D1B405D1F1476B802BE5DD2ED3
SHA1:	CFC0651E0B9000018D138442324FB2D4555075E7
SHA-256:	36A67B04FA544E6C6E2F33A5A837050136ED30360AF0FC3F96868D14F717487E
SHA-512:	5C930F51A072936B7817ABC2A896DD06961422709D2530C35330B6F79FD0926927AE90BA2F98B6F4CBB8237457473EAF3D5CD32E7943D44CEF2DE9AD366B9B6C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\AppVShNotify.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	226792
Entropy (8bit):	5.789219071166457
Encrypted:	false
SSDEEP:	3072:w4aS0s8GplWsHkz1pTFaTUYLsf1J3pWGNU6ITLct9OEoYztX0Y:P0RsWsH81pJEQ33pWGNU6ITLuOEoC
MD5:	F085259A7C14B5072658974B59FA787A
SHA1:	2F0BE555543B3A2EF4742B8FA0D5E762C6593FE2
SHA-256:	DC8300A3E3C8857E0A3E42CDB96C1636F8C1A5052A09B1ABE07A3CD410D875AA
SHA-512:	BD70B48991491F6AC49E1B5101FF298F5333694DF76C77758FDF6139711FE1E3257F920BA4F8FFC2DC1CB8500E81D5901302A186E5BDC97EA7064CCD0C6C5A7F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.P...P...P...Y...V.......[.......T.......O.......E...P...f.......J......Q......Q.......Q...RichP...........................PE..d..............."..........P.................@.............................`......M.....`.......... ...............................................0..X.... .......P...%...@..H...0...T....................u..(...@t..@............u..@............................text............................... ..`.rdata..d...........................@..@.data... ...........................@....pdata....... ......................@..@.rsrc...X....0....... ..............@..@.reloc..H....@... ...0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BackgroundTransferHost.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.3799039172752763
Encrypted:	false
SSDEEP:	384:lY81FFMhllotNxXAs5LUUUt610Gsp2YAeYgU5W0AgWLQE0g7qW2RPT/8rFeZmJhE:lY+LXx5UPt6OgesEz2a
MD5:	777BBC2E4DBA510015F23789DA4BB304
SHA1:	61B3B6EC7D7CEED71E0EFFC7B011111749E18F6A
SHA-256:	09B6ECDFF76EAF9A7FF6BDDC8108F3424F1E35675AD4288ACD3176F54C4997CA
SHA-512:	6368473A6352BE757F800A2BAAF1A91C8DE9712D51184B76E36AC64243844574172F97CAEAA2CDDCC0FB5B309E7369758BAA06533FF2C68832F4D149BCA9ABA2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... ... ... ...Xg.. ...X... ...X.. ... ... ...X... ...X.. ...X... ...X... ...X... ..Rich. ..................PE..d.....Sv.........."......0.....................@..........................................`.......... ......................................HO..........PQ...p..X....................I..T............................B..@...........@C...............................text.... .......0.................. ..`.rdata.......@... ...@..............@..@.data........`.......`..............@....pdata..X....p.......p..............@..@.rsrc...PQ.......`..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\BdeUISrv.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	4.738058947787634
Encrypted:	false
SSDEEP:	1536:YdxLrtJJNRvQvQ9ur+B/t3TPfcLC6nBEuNZyJFbx/kExUgwuo:WLvRvAr+dt3bfcLC6nBEuD4aExUgC
MD5:	094970BBD30BBB9A9F7FF8F875D2354E
SHA1:	44CBB90E305F89B5E90DA63060C0664287318C7F
SHA-256:	5B3D1935F25B05A7406B9EABF95A009420AA49332BECDD0A0D2062A8B9D6E45B
SHA-512:	32C174EAC22705850EF4E647C8A05AC5093244163A7A5D16B7730E8E1E4DF73F488030117FCDE1B77FFC3139164DADD39096B39CCE4DFEB4E15EA6F51CCF310E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."N..f/..f/..f/..oW..d/..-W..b/..-W..~/..-W..`/..-W..u/..f/.../..-W..o/..-Wo.g/..-W..g/..Richf/..........................PE..d.....y>..........".................0..........@.............................0......B_....`.......... ..........................................................d............ ..........T...........................p...@............................................text.............................. ..`.rdata..47.......@..................@..@.data...@...........................@....pdata..d...........................@..@.rsrc............ ..................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\CertEnrollCtrl.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.241752372493363
Encrypted:	false
SSDEEP:	1536:yX1QQ34YAnhH4aJUZySmC36W+Z+BPU1ZgfYHXaX:yyXYAnhHlJUZySmCKWW+BcHgfIXaX
MD5:	0EEA0A4645FB9E13899AB0181293287E
SHA1:	3F4D868B77FF4E7AD1E1D259FBEAD904FB5A86F2
SHA-256:	29BFA90795346A2EA3EC30FC8D723AE128C7DBA3A1A30B14E8AF0199A13D0791
SHA-512:	EA6A6E0BB086A333AC0B82D333F7BC61A23BCB22C9D085E3936F50C0E6CC36E254E122EA5476C592A4A8C1A1C9B76CD878DCBF3C271DA5E14C5F620C541701A1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........jh..jh..jh..c....h..!...ih..!...rh..jh...i..!...gh..!...bh..!...Zh..!.u.kh..!...kh..Richjh..................PE..d.....;b.........."......`..........p..........@....................................s.....`.......... ..................................................H.......4...............<.......T............................~..@...........@................................text....T.......`.................. ..`.rdata...E...p...P...p..............@..@.data...............................@....pdata..4...........................@..@.rsrc...H...........................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7157248
Entropy (8bit):	7.756166190918081
Encrypted:	false
SSDEEP:	196608:UG0rMh5vMNSBl4rs5EiJlLMBiLPUGylg28X3:U5QSWmkEiJlLMY7UGU/8n
MD5:	E77964E011D8880EAE95422769249CA4
SHA1:	8E15D7C4B7812A1DA6C91738C7178ADF0FF3200F
SHA-256:	F200984380D291051FC4B342641CD34E7560CADF4AF41B2E02B8778F14418F50
SHA-512:	8FEB3DC4432EC0A87416CBC75110D59EFAF6504B4DE43090FC90286BD37F98FC0A5FB12878BB33AC2F6CD83252E8DFD67DD96871B4A224199C1F595D33D4CADE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R.......l.......m......zF...........b.h....b.l.....b.S....Rich...................PE..L......a..........................................@..........................P......m.m...@..........................................@...........................A.................................. .l.@............................................text...=........................... ..`.data............B`.................@....idata................l.............@..@.debug................l.............@....reloc...A.......B....l.............@..B.rsrc........@.......,m.............@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\browserexport.exe

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	5.67309607555863
Encrypted:	false
SSDEEP:	3072:QV7/3zsK27yVjO+zMguhQIvM+PeaIiZNbPbMsGtRaylkQ3tG:SgKdjO+z/WQOM+W8bPbMsMbkQ3
MD5:	8E4C26A02B8BA95CBC54E6215A283E52
SHA1:	73C0A8707A1EA4AFF419323CDC4A5530CF4132A8
SHA-256:	D892CF9EB8B03E451A9B9ED99DCF1B478A01F57FB467D8314CB4C5E8667826A5
SHA-512:	1E971AC739FCF57B3F4EDB8A77FB664DF9275B57A9C7818B4F2D93C440F8FFA37598EAA76836E0BCFB268FF601C518BB5CA2AEEA26FEF4D41EE19DB50AAA700F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l..Bl..Bl..B...Cn..Be.yBR..B'..C`..B'..Ch..B'..CL..Bl..Be..B'..Ce..B'..Cz..B'..Bm..B'..Bm..B'..Cm..BRichl..B................PE..d.....k.........."......`...........".........@.............................`......^d....`.......... ...............................................@....... ..\|............P..p.......T...................@u..(....t..@...........hu...............................text...\|\.......`.................. ..`.rdata.......p.......p..............@..@.data... ...........................@....pdata..\|.... ... ... ..............@..@.rsrc........@.......@..............@..@.reloc..p....P.......P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS2746.tmp\system.ini

Download File

Process:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
File Type:	Windows SYSTEM.INI
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.986195774943704
Encrypted:	false
SSDEEP:	6:aQ44VvYv+WdH5rjJ30yf1fDB9fjf4sSE2iUPTen:F4YvC+AjJ30ypB1woIen
MD5:	EE600165C40F493305A7EE244D75FE76
SHA1:	911528DF3CB23863AF79E20D5E0B8964FF38AE95
SHA-256:	1D9A44084D4E22C8940EA2E79461B868FDD3C0F01F17AEF490C148B73327D5BF
SHA-512:	8D0B36550C1CE2DD304DE9EFB2A0C2524E2EEBB938E0167B7ACE71D215B1312EB12C69089B7500382A7210E04492A9DC6D5654DA1A7E481C600CC6B6E660BE26
Malicious:	false
Reputation:	unknown
Preview:	; for 16-bit app support.[386Enh].woafont=dosapp.fon.EGA80WOA.FON=EGA80WOA.FON.EGA40WOA.FON=EGA40WOA.FON.CGA80WOA.FON=CGA80WOA.FON.CGA40WOA.FON=CGA40WOA.FON..[drivers].wave=mmdrv.dll.timer=timer.drv..[mci].

C:\Users\user\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\lIVrBSt.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	7157248
Entropy (8bit):	7.756166190918081
Encrypted:	false
SSDEEP:	196608:UG0rMh5vMNSBl4rs5EiJlLMBiLPUGylg28X3:U5QSWmkEiJlLMY7UGU/8n
MD5:	E77964E011D8880EAE95422769249CA4
SHA1:	8E15D7C4B7812A1DA6C91738C7178ADF0FF3200F
SHA-256:	F200984380D291051FC4B342641CD34E7560CADF4AF41B2E02B8778F14418F50
SHA-512:	8FEB3DC4432EC0A87416CBC75110D59EFAF6504B4DE43090FC90286BD37F98FC0A5FB12878BB33AC2F6CD83252E8DFD67DD96871B4A224199C1F595D33D4CADE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R.......l.......m......zF...........b.h....b.l.....b.S....Rich...................PE..L......a..........................................@..........................P......m.m...@..........................................@...........................A.................................. .l.@............................................text...=........................... ..`.data............B`.................@....idata................l.............@..@.debug................l.............@....reloc...A.......B....l.............@..B.rsrc........@.......,m.............@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036016968100.dll

Download File

Process:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143665496.dll

Download File

Process:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036143868168.dll

Download File

Process:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036199797216.dll

Download File

Process:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036226544476.dll

Download File

Process:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036248045740.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036332806404.dll

Download File

Process:	C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036333922764.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404180036337438040.dll

Download File

Process:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4834208
Entropy (8bit):	6.8789283673838595
Encrypted:	false
SSDEEP:	98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	0415CB7BE0361A74A039D5F31E72FA65
SHA1:	46AE154436C8C059EE75CBC6A18CCDA96BB2021D
SHA-256:	BB38A8806705980EE3E9181C099E8D5C425E6C9505A88E5AF538CA6A48951798
SHA-512:	F71C2B9E1559AA4EB2D72F852EF9807C781D4A7B96B8E0C2C53B895885319146BD43AA6E4223D43159F3D40BC60704206404DC034500E47FCA0A94E53B60239E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!......3..\|.......L*......................................PK.....32J...@A......................... ;.m....!;......`=..4............I..)....I.D...\.:.......................:......73.............D,;.8.....;.`....................text...x.3.......3................. ..`.rdata...^...03..`....3.............@..@.data.........;..@...\|;.............@....rodata......0=.......;............. ..`.tls....]....@=.......;.............@...CPADinfo0....P=.......;.............@....rsrc....4...`=..6....;.............@..@.reloc..D.....I.......G.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kbqdpqh2.ayj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lx4u5kb0.4sm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfx1wdjg.dd1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ptzfit01.psd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\serversystemNCQ_x64.exe

Download File

Process:	C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11477272
Entropy (8bit):	7.98890415113179
Encrypted:	false
SSDEEP:	196608:QfUT52JXoXQWP2Eq/XJAutPwUON8fTqKYlrQHM9/y46DXKDqWDnbO:wM+0Qkc/XekTqKCeM9/z6D5eO
MD5:	E8295A7EF2D88AA3A16361A5E53FEB3C
SHA1:	B07A32538E0540A467203F343BB64E6536D36730
SHA-256:	18EC7B686D8FF469E63B2568210F5886E9E5512A651137E7FB5E8009A41A54BE
SHA-512:	FC4DA2E0F157012FA88F42D7855405E2B078A61548500501CA509937FEA78A3024B14A36EA59207A1D2C0A46BE54CA3919BE578A01D6BD93725B87B3151D6157
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."\|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z.........................................@......................................@.............................................V...............h.......*>..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc...V...........................@..@.reloc...=.......>...P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u224.0.exe

Download File

Process:	C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.5384031016599335
Encrypted:	false
SSDEEP:	3072:VXhcLiw/LJbz7zkSfF5FKK7+nP2BlXE5AkSxol8hnT6AUgC5u0qQARvEp5n4CTTm:7WLJTgGF/KK71D6M+ATIkJva54CTT
MD5:	A806C9ADE161DF230774CB3E9576FC2C
SHA1:	EE89218471387B22612F6C9D40F325403E9D0022
SHA-256:	D68E57DCF44133441298CF23CBAF3AF9AFC4B2A95A1875928AFF74571B49B713
SHA-512:	BEE629EFBCCCB379EDD6876C630CD52EE3ECC446CB39CF9A1B6B602B8CB92383427E3EEAFBE9ABF47DE87C09E5FA9B909F7FFAA3E3DE3720121D2E0AB3AC40B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...p .c.............................g............@........................................................................t(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...hv...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u224.1.exe

Download File

Process:	C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4866096
Entropy (8bit):	6.542818068158205
Encrypted:	false
SSDEEP:	49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5:	397926927BCA55BE4A77839B1C44DE6E
SHA1:	E10F3434EF3021C399DBBA047832F02B3C898DBD
SHA-256:	4F07E1095CC915B2D46EB149D1C3BE14F3F4B4BD2742517265947FD23BDCA5A7
SHA-512:	CF54136B977FC8AF7E8746D78676D0D464362A8CFA2213E392487003B5034562EE802E6911760B98A847BDDD36AD664F32D849AF84D7E208D4648BD97A2FA954
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u224.1.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....X..................5..P......`.5.......5...@...........................J.....`.J..........@............................7..N....<...............J.0(...08.............................. 8......................7.......8......................text...h.5.......5................. ..`.itext..<=....5..>....5............. ..`.data....V....5..X....5.............@....bss.....m...@7...... 7..................idata...N....7..P... 7.............@....didata.......8......p7.............@....tls....@.....8......z7..................rdata....... 8......z7.............@..@.reloc.......08......\|7.............@..B.rsrc.........<.......<.............@..@..............J.......J.............@..@........................................................

C:\Users\user\AppData\Local\Temp\u63c.0.exe

Download File

Process:	C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.5384031016599335
Encrypted:	false
SSDEEP:	3072:VXhcLiw/LJbz7zkSfF5FKK7+nP2BlXE5AkSxol8hnT6AUgC5u0qQARvEp5n4CTTm:7WLJTgGF/KK71D6M+ATIkJva54CTT
MD5:	A806C9ADE161DF230774CB3E9576FC2C
SHA1:	EE89218471387B22612F6C9D40F325403E9D0022
SHA-256:	D68E57DCF44133441298CF23CBAF3AF9AFC4B2A95A1875928AFF74571B49B713
SHA-512:	BEE629EFBCCCB379EDD6876C630CD52EE3ECC446CB39CF9A1B6B602B8CB92383427E3EEAFBE9ABF47DE87C09E5FA9B909F7FFAA3E3DE3720121D2E0AB3AC40B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...p .c.............................g............@........................................................................t(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...hv...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u63s.0.exe

Download File

Process:	C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.5384031016599335
Encrypted:	false
SSDEEP:	3072:VXhcLiw/LJbz7zkSfF5FKK7+nP2BlXE5AkSxol8hnT6AUgC5u0qQARvEp5n4CTTm:7WLJTgGF/KK71D6M+ATIkJva54CTT
MD5:	A806C9ADE161DF230774CB3E9576FC2C
SHA1:	EE89218471387B22612F6C9D40F325403E9D0022
SHA-256:	D68E57DCF44133441298CF23CBAF3AF9AFC4B2A95A1875928AFF74571B49B713
SHA-512:	BEE629EFBCCCB379EDD6876C630CD52EE3ECC446CB39CF9A1B6B602B8CB92383427E3EEAFBE9ABF47DE87C09E5FA9B909F7FFAA3E3DE3720121D2E0AB3AC40B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...p .c.............................g............@........................................................................t(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...hv...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u63s.1.exe

Download File

Process:	C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4866096
Entropy (8bit):	6.542818068158205
Encrypted:	false
SSDEEP:	49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5:	397926927BCA55BE4A77839B1C44DE6E
SHA1:	E10F3434EF3021C399DBBA047832F02B3C898DBD
SHA-256:	4F07E1095CC915B2D46EB149D1C3BE14F3F4B4BD2742517265947FD23BDCA5A7
SHA-512:	CF54136B977FC8AF7E8746D78676D0D464362A8CFA2213E392487003B5034562EE802E6911760B98A847BDDD36AD664F32D849AF84D7E208D4648BD97A2FA954
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u63s.1.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....X..................5..P......`.5.......5...@...........................J.....`.J..........@............................7..N....<...............J.0(...08.............................. 8......................7.......8......................text...h.5.......5................. ..`.itext..<=....5..>....5............. ..`.data....V....5..X....5.............@....bss.....m...@7...... 7..................idata...N....7..P... 7.............@....didata.......8......p7.............@....tls....@.....8......z7..................rdata....... 8......z7.............@..@.reloc.......08......\|7.............@..B.rsrc.........<.......<.............@..@..............J.......J.............@..@........................................................

C:\Users\user\AppData\Local\Tp59u6n2uhrgw2uPRJT1mo4o.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TxcN817CnpQUUQpmxVzV0mFT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\WIPtBriceCKAWgIcBS0bein0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YGTS10whU5xLzk2bVxVWnmYS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\YZSfYHwWFKrX6Pjkpe42m3a3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\Z53Wf0X0IoS1KV8zvVeoh9Jq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884124407997752
Encrypted:	false
SSDEEP:	98304:k0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwww:lPMki6zio75L3pf3dedO4keCIwkoYbgQ
MD5:	C2F0D0D1B405D1F1476B802BE5DD2ED3
SHA1:	CFC0651E0B9000018D138442324FB2D4555075E7
SHA-256:	36A67B04FA544E6C6E2F33A5A837050136ED30360AF0FC3F96868D14F717487E
SHA-512:	5C930F51A072936B7817ABC2A896DD06961422709D2530C35330B6F79FD0926927AE90BA2F98B6F4CBB8237457473EAF3D5CD32E7943D44CEF2DE9AD366B9B6C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\a84xxA52gOFQbQH4hbzYi5Xz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\cOM8IUNCP0DFnISRQRmA27gl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\csCwmOCWNE9UELQ4txTVhw4w.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\dIzcszODhP85SLHp5gDwads1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\dYzlQyYiVhnqA3GhRDFvHDg1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\f0h4XS72dTppZnfmwBjhUBEA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\gtrlRL8HQLBmCrpj7eGii9RV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\i3cGHUfhs02OIuQ54eKiruit.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126803368091
Encrypted:	false
SSDEEP:	98304:f0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwg:sPMki6zio75L3pf3dedO4keCIwkoYbgA
MD5:	47EB5DBC3AD1B569D0776F4CBF111342
SHA1:	7C4A9800EAD26F628DE6C2E978242277BE707960
SHA-256:	7A23897DCF9E267246C03EFB73C166D9D9B90B42B1913F87F3773B807581C3F5
SHA-512:	AC33DDB04428CF35E519C4566DC4A63746600B1295F36942F26BD2E28C2E619AB031E5985BB7059BAB2B92F97728EFC82C30E81F1547CCD8ED4A68132966B78A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......(S...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iUqjJmkpzyvK9tYYVEHTZp1W.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\iZp2NZRM4fCHBLrmfY5yxs4H.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iiOuEJn1yBaeJOKc16avXLXi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\jPR83WX1aF07mPj541WJbft7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\kTljKlVr9ONLnjGfMDuDLqq7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\kzh8LUeSpUUvzS6kGzWDItYc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6802728
Entropy (8bit):	7.996235974818118
Encrypted:	true
SSDEEP:	196608:91OXbE7giOz8u70OteFI7tfL6TCdPeMLN3IA:3OIBOUIECdVLN4A
MD5:	5D5DA0738299D8893B79A6C926765E5F
SHA1:	B05C2CFD30CA1C163CB829B7E7E5EA2D6C57D1D1
SHA-256:	53C80BEE05D28FE65AB0AE6459753FE7B804C0B68B85FAAF828576687EF28CA3
SHA-512:	D9FFFE943131E71762F5E2E1AD3D23053069F0F028054BE9EC2C8491A6812ADADACBF099AB8FA79CA9916CEDA14CCAEDFE4A0E1E5235871A97145EF77D7B0B26
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\lxJL7FOaOc6Tkk0XNttI4ctE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\m17a3Wi6OxEiO5FsOjI20tNz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884128419820281
Encrypted:	false
SSDEEP:	98304:P0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwh:cPMki6zio75L3pf3dedO4keCIwkoYbgB
MD5:	5E71284947BF8E2B1B90B843D650CA13
SHA1:	9C52DC35DC332632569056816836B747F73BB238
SHA-256:	436FCD6CC8AC3A9761939819D7CDB47EEF995145BFDD7BB5A3FF302414878875
SHA-512:	DD8989FB9E67D704F4F562C6D12398880690E1FDC27022F705470EC273C85D3965E0230203576C564F50C0BEC5EBC7F870CE2A665EFBA4A8E0ACC78215B1D2F0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\mLelSKT2LDJXIBhhiZbtJLRy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\mrFftTFMgiVG2LP46B9gKHBo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\nRdMq8uD8Vn50SShh8GGGF1J.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oQDwIFVWS8CDFis7e7hIkdVf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\q1Wrkjlqz870PPzT0bIAuAXE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\qWJzemjmehRTjWu4hQlmexeK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884125904829497
Encrypted:	false
SSDEEP:	98304:y0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwww6:HPMki6zio75L3pf3dedO4keCIwkoYbga
MD5:	611A07F1F59CB67D20A7609D6444442D
SHA1:	31B42E9431BA12416B2336E83BD0730D35790060
SHA-256:	854BD34503D6676B526FF736B40FB3A65A2C089C66D7728BCA417E699440A049
SHA-512:	D948E425E7BDCDC5C2AB7C0D7D60F133A964BA90F58DEDD5060A097F25D44B87DC3E5CD0DF9DAB378D46BC11AC206830F0137EA15A8CC17F99A4AE22A2B13055
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.....?.R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rgIKhNst6KD41QCemJfU8B6e.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rqCKBzP3c5cie0ECqyDcHMBo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sZo8dt9VSX8cm31TuXOiptH3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\si8fAgQZyD6Cx4plDNMQadak.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\vRRDKxJPSQaL9EAwTnxxq5Xp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ws45TNfHbiigh1rlfu2kvwqp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\x6grxPSTyIeA8EPDMgptrwYO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126316660053
Encrypted:	false
SSDEEP:	98304:90NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwk:WPMki6zio75L3pf3dedO4keCIwkoYbgE
MD5:	EF199316DF30CB4E02F45F156EC63A9A
SHA1:	1D01117469FE286CE64CD27DFCBF939DFC7E8F22
SHA-256:	858F0951DC8F6A15014CE367AD4CD4274D93881AA5D0B101ED524389CD25BE3D
SHA-512:	F7BACAE2D24E570911358EDE0B56CC0A94713A1CEBC47BBCB9D83AAD3B357F7CFE5494C0CF5BB2972542F469B9538BAE0F9100C3BBA918DE71040E9FED8C5A9E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......\R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xMynrpRscnCMe5EhOaqNgT9P.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xWO4HdGMj74aDnNwcibeJHOS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\AppData\Local\ydXU53ROIY0b9rjoj3B1m3C2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\zU6BSyD8WoQsImtLem5lAF2x.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J7M1nQjDGRXKMq0AgiKFOvO.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.882014449776854
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5uKce2JUSpnJF:fE1wkn23uK52e2F
MD5:	322CC167912128E7F0186FECF8FD74A0
SHA1:	DD0AA631C5A41CB05C56986D75CCF480A223E364
SHA-256:	65067F7F6CE68F30A98E668966740AB19E523F441C1348903EF6773D353096F0
SHA-512:	3D0805A4C6FFD40FA8C7A8AC9C7C8EF12D2F5FCA6A55E61818DC2E50F8F2DAEE40E1C043B11292C2700CAFC24C3449E6F4774ABEBD4ECDAA4284875DD3FCF9D0
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Kocn1QGnt5lNON74XhjpO8L3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0L0N3gvArkRU6k774A53L7pm.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.916657341451682
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5M/iHtL4mn:fE1wkn23MKHtL
MD5:	9E08D855227C8B3B0F6A9E57C3834DBC
SHA1:	99B509AFDC13F045B9BB0C760C8D0FC105C19F49
SHA-256:	3AB7E53C6F5C660822C8F23B164500A3817AF5B9237909BC80EAE0981C950659
SHA-512:	D62DFD30B46CFB737BC5E9B566C9CD09C7BC8B3F2698E5E5A4013AAEFABA146A21E158A5EAF56AE5F18F34355989129A56F4F71DFBE203DBBC7DD68FE235850D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\iZp2NZRM4fCHBLrmfY5yxs4H.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ikx69mladtPGsRKabYNZ6t0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.921940355605309
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5kn4k/RAicKLvn:fE1wkn23kpZAicW
MD5:	FCF184D4D20F05CE2BD56DB50332D66B
SHA1:	613E4AD917B592E5EC1DF18A37BA6D5AFAB04050
SHA-256:	91A894C09F1ED14BE78936E586F5BEEEC2404EF48B717FC0CAC19E01E9D2036A
SHA-512:	1F0985E8F392202518EB4F2A4F0470F9C2D4D50D60E97D3C4C2E58894AA4961FF6A2E7DA16E8DBE7BA378D9B0277DA2CBE8CACF79823C6E0D16B9829DD9C68A3
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\A6zIGniAZ7NEfPoGNA99xdJC.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0syZq7EY0CFhtffF1dHMEDe0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.857239001305163
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5fQl/0s1rdJln:fE1wkn2320s5Tl
MD5:	406952004466AA39B5DFEBE0401E8269
SHA1:	EC775A66399AE1BA89CF0075558875A08AAEB0AA
SHA-256:	069B550957301032BB5814B3CE922B5DBA38F48A8ABEA66515194F4D32BCF76B
SHA-512:	0BD7D04FE9D5E0B745A4C81A7BD9B3D10943F7867AFA38467892376CDE14D2686EB1ED18A6770DF7150A4FA4221659819F2824D0EC7D18526C5B0DD8AA7904D0
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\zU6BSyD8WoQsImtLem5lAF2x.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YGFaax4VREMAQhHWBVtU9ND.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.929045065687527
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xVJcoXkv7K4F:fE1wkn23TKNbF
MD5:	9E1BA20C5E8DE0A3FCDED7B6B4AE8E73
SHA1:	267A70188F5B83B8FE2BE0541F8DF8B7D773E1E9
SHA-256:	F2AE6AAAB8862131DD63213D61DDC6C7302A85408C6FB6058155F8CFE60B75C6
SHA-512:	65DED8BAFBA94202A1AB48DE2AC74D658426C3A4A496A5F2EA60398C2E7F7A503F07B2514937B09092C4D2ECBFBCCB4AB0705E2C954030F0BFA683E52BE1D186
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Tp59u6n2uhrgw2uPRJT1mo4o.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2ym1d1xnPNMzk5jErdF6V6UG.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.003613863190812
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5iS003cCl:fE1wkn23ir03j
MD5:	38BC31C032CA59716C6541E920F3AD69
SHA1:	A30D02E05398441FFEE0AA78EC8DE32B5138C93D
SHA-256:	0EB830D545629E91BEE7C9ADDB29FED893E2A8DCE5BCF91A1C8C1B45E026319F
SHA-512:	875F0AAD0DAB90A5C772624E89D91C40B1C4B92F07F6072E85EC51F099BE79D20BB6BE4D3AEE92FC4013B54ECD0976F4BFDD13C7B955E113FD023E72F28B2891
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\GNcg3yiDrmzw07ZdoxfNbs1v.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3PIKZrWnwy05CxuZRskqCwfF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.894776544287524
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5qHC4lW0blbs:fE1wkn23qNlWSJs
MD5:	D7A971F4840FD8B802628291A17726DF
SHA1:	61CB613BC4C0380057E51E0948167C177E8F93F8
SHA-256:	3ADA35427A3DF63404DE2563A4FBB47490A50998F9FA149CF35ABE6917B680C7
SHA-512:	C1AAB1E42EB12F109667FBD644D8C2087F06FD1DFF6E4ED14255157C1C6C595F1707BDD4C1DD5E7697FCF0BD9E974DB15530116E27A79B298A1E839971F7B0EE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Obg7n5Z5efoxTsQrcye3Rd29.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42AtahIwsAQ9MCwYdGXiMWgl.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.00889687734444
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J58iwBwIpgTdeLIkAl:fE1wkn238isi0LIkm
MD5:	61CA720CDA3E4D60CF6397527D85682A
SHA1:	681C1587675D831D96BC386F1AFDEE5B7969A158
SHA-256:	A13706E13087D0FD7ACF6DB8E2F580D7DA0E766CF8BB309C20C2DDC10901986A
SHA-512:	3F32CB1C69B0D79392897165AD8EFB75D364C60B39C9C68C1CAA35AB345E8CDC3439E6E1E8800A1141A7112038D8261860CB79A9C1C882DDB30BF8979B1BAA72
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\YGTS10whU5xLzk2bVxVWnmYS.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4LIdC6j8pRS1z7WNkoaxi5da.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.84774592837685
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5SmXx0vPOVQ8x6EuCl:fE1wkn23Sg8ZfER
MD5:	11316C6D8E24CBB5F70FA894CD528430
SHA1:	BE69B363213AA1B7EEFCB8C5A2070218C7692860
SHA-256:	16F96A9180C8D53A75F8E099E58F002E6674E28969E42BD2F18F9EA4C6A98516
SHA-512:	77A296AA825BF383BA15247CB16C4512AEBCD7843DD7EDDC88C093BAB1B5BA1B879F2B4A9BBFCCBB90381566A8043E33D20F7887FCB5BDCAE9AF688D99FAFA32
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\7GonYrcCQJRZWxpQLYX649aX.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4Y9Dve63bMlMJwgLFapHtux4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.853403312805302
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5UZfqUHson:fE1wkn23Udso
MD5:	8D5A9F9747F567B1D9EC38D3C6D525B0
SHA1:	4D514403012786489BE7DE75476F5F64F9B5BE7A
SHA-256:	F74EA9B9B4F0E6D758972B57B0A558AB97A5F5F621D8FB5E6A2AE2F99F2DDCE9
SHA-512:	AD1B426F7ADFF5862172267C0121CF2A889E4A56274763BEF07BAABAB05F8D68DA4FAE6F231FE42612BE62BF29D0B02707F545D030C7561974C9ACF2F0C87A88
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\1sULHHpeqbgWxmRBkrwHQ2Wq.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f4biQVfkFFQ1vVSgVTRMMCQ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.858686326958928
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5XBftvDwdnYFn:fE1wkn23VtvslYF
MD5:	369732AEC60D1A32DDF240050BDE8620
SHA1:	C6269F618F1A65C8ABC27611F4C84AF70AB27A8E
SHA-256:	AA2D1EDAC638E0F89FEC59B68DCA7882A74301BCEE4644A254A98032DFD58F79
SHA-512:	582A155A8BBD08F4529AF6CB72AE45B72589604212B5E4BE516080A6E97C19FC43270A7140590BEEEC9ED504C07E0235B8679F98CE3E461BABEBAABADC57825C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\rgIKhNst6KD41QCemJfU8B6e.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5DvsXqu7rhEgw2bNo52xP7fS.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.878178761276993
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5O3u9XfOUUSJHFn:fE1wkn23O3u1f7LJF
MD5:	6A5728E0FC5F04095AE938046F92489B
SHA1:	D8EE3F91E88E6E81B283435A3145660F04394BB7
SHA-256:	1F924A4114DA4F01ED1DF524E5F44DC2F846AB2DC62E9C35539B56933BAEA983
SHA-512:	88CFED81D81E428BCC1079C5638AA9F2FB91E3A749E5A7BC3E2581DD70297E52FFB202D45136751B99346B73C489E17B486C3E26FBCD3B2955F8F847E3A055A8
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kTljKlVr9ONLnjGfMDuDLqq7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e9YTeMdvgg279TXXoNtMM7p.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.054480167601348
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5RAHSYTDY4mn:fE1wkn23oD+
MD5:	A51A8106F02768240683DC9E3E9AD6F4
SHA1:	75C51C02EBA60324C74CE2236E74E13D6EB56813
SHA-256:	6C0E72087F52E223DCB2D5F412813E20053CC89FFDA999515D737D9916399863
SHA-512:	9C429E7C5509C7E019FC263AEDE28E5C6096C130F1B5C881D485F0BA7D71ADBA35F10CB3CFB697604DCDA1EB2FCE1A3BBCFFA77A985BC27AEEB56BDCA6C5DF0B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\4eN6JMBulbZWTUqm8bHwZ2Cg.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.008896877344439
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5KKBaHXyCHF:fE1wkn23K4aHiCl
MD5:	BC9406EEF44D0B8DBB55E049F89932B8
SHA1:	5623CB52237A7A8A680D1A52ABD4E231E6FB076B
SHA-256:	8EB27AB1459005F132A984B4B34C3E12684ABAB61AD960F3E2D36424DD0E1225
SHA-512:	ACFA94649926D5413EAA4B5C2BB4D24AA81D2BE9D244B85EA0C5F11296D704438A0B09A4AD4F8779A230488CA88C51940BB5B9FEA4E1653F89F03FAA6A6C5EF6
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7wRR3Sd9ebwAodEDhY9Igh21.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.054480167601348
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J50sdlNngIHv10s35Jl:fE1wkn230sHVgIHtV35Jl
MD5:	CEB322A7E2072066FBB2358F6A8B639C
SHA1:	4EF7FC6F5C5565991717F7FA93138F243D14A40B
SHA-256:	412B76A351BF8ABCFAE62DC3336BCEEB8D3053ADDA2B5C2DA844D5290F76ABF9
SHA-512:	769F520B9CCCFDC353BD78C3B6ABFDF64C01070F40132A3B723D9B2E5D1B8443359DACE902CC36A0C2036B30F1F82989894C4B55E2A51AE14399509339C938D0
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\QI8XvF6duFZ0OdsmbJPQIRnh.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9Xgc4e7oTv5WiPHkhGWgsF6U.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.008896877344439
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5IvXlZcC3Adm:fE1wkn23IvXlZc+
MD5:	FAF7D72EFE6A1B6BEEA4761402BE489A
SHA1:	AB0942437D5DE5CBD26DD35DDB221007674BBC79
SHA-256:	2BE0C89E113E913BF4635F787262008D1CE4A7AF5EE15E373B9A9722A29CD87E
SHA-512:	B37BB220D687527CE6DFCDBB1AC8B1116513AB0186A85B6157099462FDAF85A102ABB32FF384DD48D4A9CF2CAA930835C7F8F04153332402582C567D6D8A6020
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\mrFftTFMgiVG2LP46B9gKHBo.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AN1sPJSyeZAaO0fgnCn2d82e.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.755132022209268
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5yUHnnyHpd4Aln:fE1wkn23yQyHzNl
MD5:	E1E38F857F4C56DC4543026F2F87FF2E
SHA1:	0B5FF957142AA49F2B4CAE2B32FDC05457BE1BA7
SHA-256:	27AD889A3B7F8070D4C97612F7DA1C417880F4A8596601A2FABDDAC295EB66C0
SHA-512:	519B4D2E035CF93B0D97C90F06D9D0049BE2105F3904171851DE16A268D817C06DAEA17238A4A39B7CC77632D012E1782415279A4A1F3A366F074B9BC9213BBD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\WIPtBriceCKAWgIcBS0bein0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcYm79bKwGS9urVVZVjxlnOT.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.847745928376849
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5X/CQA9FlQv:fE1wkn23PCQZv
MD5:	D64B1602005BF952F69E73E242904EDC
SHA1:	989F88E828F5E82FE0C3D816C86865B7448D0303
SHA-256:	83CF170B418BAECB1C7DFAE5EE1252DED46661B0DC070743251EB532728059C4
SHA-512:	BEAC6CA4F62B1CEFF36D7593F95A43E442DB55AA1190B9A29512108B2999EB491FDCADBD0DCA08A06930127733E9523AAD1527B07AD73F40CB273A886422C80D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\rqCKBzP3c5cie0ECqyDcHMBo.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bnux0XctxY2jUEcQFRrG9ED3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.025494660354971
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5uUzH9nWUZL:fE1wkn23ukH9nWcL
MD5:	403E210F82E7A9C756B1AAD19B048099
SHA1:	5824085B937CF2401F8574417B7748C2CED2AA0D
SHA-256:	32661C5D8B3D3D9A9C7B24AB8F66952D7B123032EEA45D44763055B790FB1068
SHA-512:	2A6F21BF670D2BF9DEB444B3572ACA28ED8E4C4ED5F37EAE08CD6004E7D287B735C85C70F73FF153B006B7EDD2E1A6E0D369DD99A095491EC6572A1D039F307F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\KWbVzicuAiSBYHryJZst17v9.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2otv6cqxQYf5tfWSc9JYFFI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.840641218294632
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5GWlXROsMd10SJl:fE1wkn23GWlBOVf0SJl
MD5:	BE95F2B2AD804C87148CF6173D7310E1
SHA1:	92F76C1B23CA082C1CA389C77836825124DC1451
SHA-256:	6137C83249BD163848305323150222ACDFD03A8631A9918DE92DBD35B32D052F
SHA-512:	232E043FC90526C5804AEF014000F7C5BE626108F81DD1F285CC6FFE006E2E8FC669AF4705FD1989BFF47AF9A2627D49349F0B6A0C617F05412CDC9EA3E348A5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\csCwmOCWNE9UELQ4txTVhw4w.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CVcuVNYe8YDJ4yNu7pIFMe6h.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.980285740372887
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J58/nVujPrRnAdm:fE1wkn238fVuzrOdm
MD5:	601A93D9A9BF2B72DE849A7789EF6CE7
SHA1:	A1A691151FE5C40A65F1BCBDF875ED8EE1428D9A
SHA-256:	C3872EE4E4718828D1C3878E3EB32435CD7CA801E7984FB22B9FBEE90BA46C4F
SHA-512:	031DF355E0B62006964E6587D19CA94A224A328034CAF4EF03A4F37C56796E20D317E7A0D7290D093698818DF26AB7ABB774ABCC362F89FC74F366344619696E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\YZSfYHwWFKrX6Pjkpe42m3a3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CqLkLJsKMzyqpGaqpdD80xX4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.975147613396141
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5IPKWqPC0ClIkdan:fE1wkn23Il90CSD
MD5:	7FA4C19F84B95A92E4563055B35805A0
SHA1:	867986703C1DFC1708A6CEDEB5829625CCDAC66D
SHA-256:	5DA2B537D30187623EF77ABF703D88CEA833259216EB55818AD0079BCA88E0B1
SHA-512:	3ACCE930E947DE99DDD0A411975DEE18086E9B14409CCDFE0FF9183DC13A652CD9A5E6AABBBC574BD9060D764668F7B62E64162B1182240042A1F8073E1A06BB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\m17a3Wi6OxEiO5FsOjI20tNz.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DJgk52sDeczUV1lmMmKix3k6.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.979911370098063
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5mOOVpdYdm:fE1wkn23mOkzYdm
MD5:	E17B38BE98DA32E08D32A1D5B0995FC4
SHA1:	12F2A2D0BB0829BFE10526E9466DF325D493A900
SHA-256:	B99FA616B1D38F946397B6E2AFC6B07CB143BFF4ECCC762FAC65A2836E98C2D4
SHA-512:	A94B0954A358B271B082E17CCA0AB12548A6331E9532911790A34F60F837406853BBD83E637EAD3DB506848C199B86FEFA1F6084BD2F178429CFBDCA95EFFC3B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Ckxihb2NQynZLzb7wQqDjQv3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EXyR1877y9OTHbL7SmwL0Njx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.881743480545401
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5vJ98UzGqUXQENHFIkdan:fE1wkn23raq6VyD
MD5:	594EF770C69D25B144AA379DC2499C50
SHA1:	239798A6041101E30E90F040E913F0F7E3CDD30E
SHA-256:	66747FFBB2B212031AC4B3746D96F4E4A00B983D88162E6C7030DD9380382C00
SHA-512:	04EB5932888156ABE2D2970B8C58D9F15AF786D2FA5A9355608814E4464113E3B258F508DEE9A15980464531B717B13EBBD0EDB740C89369EB17A7E62765374A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\JN1IXYA8ssOWcLaqrtfgX1Ue.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ft6HRmD3ARCfJ7A7sFRbGBMr.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.811655711048255
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CRdt0GQPj3Fn:fE1wkn23CazPj1
MD5:	35F077F2FF16B904E39A735290FB4327
SHA1:	4988864B4E8101E87D6012162CD949BE163C4D8F
SHA-256:	F3B8458D7B2A3C5D5B316EEFFD3DD712D5BA0D7BA12F6513DA2DB88118F6B27E
SHA-512:	2DE5D9ABB07F7AAA3E0D47FD513D85C4499DF870C14229585E4C0AEE1A1A922F9BAD4A097089BCD41F1AF3F789B562E8A5FDCF536B9D873D3101508840525D66
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\gtrlRL8HQLBmCrpj7eGii9RV.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I9qlxtKCRbJZBgSVyvQk4qck.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.958030572933904
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Lxo5E/AhdiFn:fE1wkn23dofdm
MD5:	03069E60D1B7412398E2DBDE72A283AD
SHA1:	3FD2DE5A7F2BE5B78C21D29FD717FEFA462A9FF5
SHA-256:	5A6E9C0B72496231BA9B8CF4149590B0FE4F12353DDCEE0EF0946B8B31D15693
SHA-512:	AE25DF1A10E3DCFF2370FC10E704676C5C6BCFA905478312D47E95C66C70990B81CE56854740100DBD228DD6D828DA9E68D430D661BB71A1B21710E01264C42B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nRdMq8uD8Vn50SShh8GGGF1J.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INrPttZcYp1b1IDxmBdj2E7I.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.782670203801878
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5OfPJdkm:fE1wkn23OHJx
MD5:	C4AF698664E30CBC5174238919C8EE7F
SHA1:	16B11664A7B4B5F6CA9DF24181A52BBDC203F5A3
SHA-256:	5FFD689DB683C1841C42A5D0F2D3568DCF3068474B1B810122406E273794C2BE
SHA-512:	9CEA1215E99702E6A4D85748981F7519F6B9CEB50C3DDE6971C533E3E6DB50ECFC2A45E1DFCF82F7A008AAB59D6525C9267222D6ED123A906EC6317DF5CD377F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kzh8LUeSpUUvzS6kGzWDItYc.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J4OoATuxVsfOKcXUcxOLtc1U.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.900349836553262
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MUtwgmR4XQ1/kdan:fE1wkn23MUCgmR4XkD
MD5:	586CB271D4FC8D7DD7B838DBF45D1432
SHA1:	29D0E1D28BD6A7B50FBB41716C218F2ADB2BD3FD
SHA-256:	47BD872A72D9A8B7F19A8A5A844CBC91E322BB6E18CA85AA2C1E31B2D3BF62D6
SHA-512:	458273CFE421CEB3E2E90387998F2062AB0EDAD68D2DE40F6CD38EF1488645D5470C4B6563A4A93B87ABED5A0DD6130C4ED810C4869E1D5B4DED480123991EAA
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\i3cGHUfhs02OIuQ54eKiruit.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kt7mfV03aeWQu4bZPgZ3e2n8.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.88622450855154
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Qm/7iyfMVAc+4AHFn:fE1wkn23Qmuo14iF
MD5:	C15238CB89877A4F0D24A302D97D5401
SHA1:	02943679056FCEB0BBFCFC46139F5E7F77355D27
SHA-256:	74238035E7FED974B27245F384614EB6B3D194EA6C2AA4831895932D230258AF
SHA-512:	889E4724731779D988F0A32D9AF1D1D7F5590596955B18F912AB0755B307D55E82DCEA23A22DD03F5B9359DA3D00B4A368533B86046F8DA48F77D74244A4DBBC
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\5CSwXytovRGWzicTtxKeyiOA.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MnlURaBerk6x1crCbiGPEJWc.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.990851768680142
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5GRs5J3s2uSVsn:fE1wkn23Gu5sTSW
MD5:	0E031FBB059BED22F18650FAFE8B7017
SHA1:	9CDA73AA555CC5B248DDFEC1A2DF77CEE1733D22
SHA-256:	A1757F4A25D50980C8A468C99CE4C05CF678BE195A274297CDD3DF9E6232C87D
SHA-512:	2151547620E2A34ABE83E4D78D7DE4D51F0567FBBBE9D5EAFBC8AF5331DCD9EB8CFAF2F628AEA4ACCB003C7F2EF1AE88E8DAE7AFB2C853F6C52404DA8032A601
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\cOM8IUNCP0DFnISRQRmA27gl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MygBvANjLf1AX31Xj7nu95Ot.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.909552631369464
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ggIMrWamJFn:fE1wkn23ggIMUJF
MD5:	93A138D238BFF7A86CE495711BA9B068
SHA1:	E42E82806E4B4E1C957B86AFA0BFFED652A9AD78
SHA-256:	17641DD358A59A5265BB26CD334D3D3482A2AADC9AA85A728541637C066C4820
SHA-512:	715EC8DF6E8B99A4770457937A61EC25C172FFB8509DB52A8CB55C20CDC40878E89E10977EC707D9193CD60971B43D042F86536E4320FB0B08D2615459F7B626
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\EEmi2L6GuCPkhaixWFWgtXmC.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NZRD5waRyhBspSGbBIm0gdm3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.927597740033762
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5r3EUEhTeTAHF:fE1wkn23z6TeTAHF
MD5:	64B5DF2E1DB3A480C878D52C1C992BF4
SHA1:	A15D7C4316D83F55311966179625C2CEB3B99EFD
SHA-256:	469EB98CB151AE5D335E033E373DDA21F320129E8EC5029AB4313F8A6058F26B
SHA-512:	C966A44A37051056E53ECC75A93A56DAD02BAB16C8D4B9CDF769EACD200EA14AEAEE8E98B4A8596179A51EF09ABCC0C3C6BABD5DFEBB87F474BCA72CD54C3F6A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\NOigbqKnljqgR3qaRHEw5cN9.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NgmAydJthTuDbZVpKKk96QRy.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.893329218633757
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5KYLz2wW+HzXAdm:fE1wkn23K8pz4m
MD5:	F96C033616D35EB1996135527DC353FE
SHA1:	CDD68F1DD8DEA1CE1B9C16E4C9E56FB0D8B4457E
SHA-256:	0DE4E10BC037B9E4DB70607BD0224B8A4EA3C784C986E3A739FEB87C54B50F98
SHA-512:	431A1A008AEB37508C851FFC5037AEC1123E287DFC8D791A5E7E90B1A478698032C3E99E0971E2DA285C7D0357D2CE45177B7B02F7CB22ACF11F35B89AB64EBA
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\oQDwIFVWS8CDFis7e7hIkdVf.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PnT9ZbC86TXnf3ynIc9924V5.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.83680552979477
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Bs8xUEgxAHF:fE1wkn23vxdgQF
MD5:	2F2D51101E4CA640B30904FECB1119E3
SHA1:	7BE9670013217B50F0B9F45253A53E2ECE9AC1F9
SHA-256:	4F8CD8BD8B0D1D8F4DD7750A21F2D4B492A91ADBFB28AA032B1C74AEC828751D
SHA-512:	25CF2FC881D2AB8E7E19E95303C40066624C93D5ED9F8EB5ACA3C00E29A709E8041F825BFD0EE7C124955D458AE9009692CA424364F0F84FFCA53D5D85248B69
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\dIzcszODhP85SLHp5gDwads1.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qbfh1kEfJzQeidHl0GsAyFET.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.990170425876665
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Wkkdan:fE1wkn23WkD
MD5:	EBF20D9CA792D65B531C46B389D90B50
SHA1:	B72828FE6955B6F4EFA7945DE13EE0D8BC964274
SHA-256:	BEEE656199FA781F42C5BC72E9454D075BD14F5A62288DCA2659923D3A038578
SHA-512:	563F9C5CD4FB3671DD89997F4D5775AA809DE415CA57E39C268CCB385D6D5C54FA38734C70A744AB0C8889A9D76FFFCADACCFEDC97B23CB1AF2D0123BB03CCFB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\31Q0tfhZ3ZbBeSnpH53Q6cmR.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VgsxHcqWGMZuJZrJUV5SLHQ3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.829700819712552
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5JdUWDG9dcv:fE1wkn23TUWIdcv
MD5:	02ACFD69D4DB47D6FF69B0B17C3D15D8
SHA1:	14DCE69ED359EC5E81604B04239B54EFC9D7B08A
SHA-256:	9BB407AA11A791975B758AF01299467B1D7CC7EC84A0EB2D7D349698B7711A44
SHA-512:	3E40B79E3C37E2AB920BEAA6D93FFF3EE186FA23ABFD021EE0D08545298048866B5DC7819D4D3A94BA2795229E3DDF21D8C7DF6267C6D46FC0030368E53DB0F4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\lxJL7FOaOc6Tkk0XNttI4ctE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W8THWYViNOUp58e0uu5wCwhd.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.958030572933904
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J50wNMegOyoW:fE1wkn230wNIO7W
MD5:	BC16BE85619FAEE2B2DB1C4D4820DD17
SHA1:	B680FACC723CEEC4B30BE6248D8DBF23AA9987B8
SHA-256:	E6CA7138978DF2458B434865C39218EE94C5694592CB17BD3020862F7AF29F1D
SHA-512:	2FD326A89D40715D26715866025E340CE8EA92B7AA830F80FBBB37488F7C2CBFA34630D79A081822225B75D1EF264282560509F92FFFFA04BB3786CD76CC6202
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\QULdLniTDqWIS6ivnfEkWMUZ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHd1pNJmpFoM8sqoNNUE4tf3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.915210015797916
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5dy1sS+tqsVF:fE1wkn232+tq+F
MD5:	981D12B8C8C51E6250930A704CF39509
SHA1:	BA813E51326BDC6FB7767E87E9DBBA10187D5130
SHA-256:	81DB71254A368364AE992C5A9F2BAA75E3DF3A6173772BA2EDE87F01C14F7083
SHA-512:	36772A137A7755F7F607EC6AEFDC66585493F83F5BE3FA0FA6F9D8B08C45D2B70786AB351633D7CBEB15DB77A1B69127734A879D888B3F56545A0DA7BEB03694
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\xWO4HdGMj74aDnNwcibeJHOS.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsK1YQ9kvBcxOEKHHnifbuin.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.99795647876236
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52Q3LMn8ifk1El:fE1wkn232Q7UhfkQ
MD5:	8670F0041C3CB0C3FCE18D7130E77994
SHA1:	397566A20393BA4B2E00B744C31A6F05F603B53B
SHA-256:	F90E2EF678834B0A90EEE92388864B044C958B7FD78ABEADFBB1E73F41B31233
SHA-512:	A812BECA1707AA6345DB4D1454B405330E5D51794C30210F5FD3E1FE583A10F0253713E3EE7C0D7FE4BBE10925484D558A4EBDBB715ABC15EADA1C46BD44C0AB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\SuRnIHuWYWEWXFXLcVP2Or9Q.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XFHdSFO3188VoWv0QrQcEWtV.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.830075189987376
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5docjV39OyCxc6m:fE1wkn23njV39vyhm
MD5:	3058A221674575459ACE0CE95BE4DBF0
SHA1:	54067866BFF90AFE2B643EB756C4EE431FCD490D
SHA-256:	D343DAFFF4E1D89E40F600A9E8E78D86228C7BD1BEC0D2993E7A3054672A6017
SHA-512:	E8D9B84BB3A8A693B1DAB418C10D22495E6B11D20759349AC1DBFEACE061074F287C648E2288303BA9EE8D5EBCDFC4E56FD269D096B75BE356E9411660A1FB11
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\xMynrpRscnCMe5EhOaqNgT9P.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3oAYVErrIRWXBbeGz7YmX13.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.824043435284101
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xdVo64XdAln:fE1wkn23bWtCl
MD5:	DDDDEF1DBA5877933A7764DA9DB5592B
SHA1:	FB8C69CCEFE76A04DFA8E6A13F7DB84A02A4B76D
SHA-256:	B374775634BB2D6CCA083EA1DAD74E976BA58AFCFDD25BCAE19B5AE0CCC5B2E1
SHA-512:	59FC080577D9AEDF71ED6A54D77240BE05702282308EA165ED1732F0B00EC110E0CBE03EA594D37379762D52BF620700E8EA109ACB8E74489BBE197C2CA39B30
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\TxcN817CnpQUUQpmxVzV0mFT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YeU8iF6BbqbTpHWTeh39oBMV.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.030777674508598
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MwUXBiT+H:fE1wkn23MwUXBOK
MD5:	98EF7BB7776C965518AB4835123EBAA0
SHA1:	5EC0EC18259EC6F70313104E98B77ED2712C7310
SHA-256:	46BB2042887AD28A2ACCFFF0714833DF2EF9EE629D2BFD8E0FE7E341F352723A
SHA-512:	A9176A66291D6AE3EC299B14066EF3435A074749BBBA9F2C0330F7DDEFB82C43CEA5F095C1A18B9A99BFF2BD9B66E59A1B700094554603CC527CA06C690C6229
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\iUqjJmkpzyvK9tYYVEHTZp1W.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZVwZaD0pkoPBTQLpyiUwKvm0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280137
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ETxpFRNH69Dn:fE1wkn23ETxpFI
MD5:	397E86D53FBBFBE2ECBA1902BB88C35A
SHA1:	9846E7CD1D2E359CC83BAA99FDE6890961ADC123
SHA-256:	669E656C8D4A01EEFDF73A0BD322258FBAD911ADFA5EA4A8F86DE87B6DC19CD5
SHA-512:	441E9BA32066F82577044BEADF9B05BFD0EE1C489D8AF387BA24479A917CE2BEC230BD3D1D32CBAF0139BFEBE0CDF3E5E1710B04039B78F621F9835087D9480D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\a84xxA52gOFQbQH4hbzYi5Xz.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aCZd0jUEZLTcGXCh2D1mXI8Y.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.974682680285403
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5u7CyAY/QiBLIkdan:fE1wkn23u7C3eqD
MD5:	6454635BF7F8FA6964482B9CAB1EE18F
SHA1:	5C53DF1D19F12103224C7814CCC4541958B446B1
SHA-256:	AEAE37FF708BE6D25D6D05C6577BE1F54759E96C15BF5D2D8736041D982758B6
SHA-512:	44F51C2A28F0C580EE39DC652BA4CACDAE118C89937AC7CF5AE10E7AAAEB85FC753D61EF017BBD08BE6872036EC85B9DC79F56F0DD32D95FD84B2990B75EF651
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\KV2qLRPax2onnz5Ndu1Z5G5q.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\alXN5bQawMu1k2uk8dHN6LdQ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.091497264529594
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5/QWdsg0sIkdan:fE1wkn237dsvpD
MD5:	C993E2AC12076A3182A96AB22D701AEA
SHA1:	141CB68D401CB54D696AB51A06D9DEC16E149A4D
SHA-256:	12E8C5EE8AD2B52D8DC8CDF8A4A049DCA0A8BE119119875CFDC62494C4EB380D
SHA-512:	7BFC52FBE0B74A22C27D5FC08F2BCF63164FD28BC51AB173682461963E01D11E8C9DDB232C6028C7CC5D442E9145997B50B0B173203848DB697A7B35BD3A2740
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Z53Wf0X0IoS1KV8zvVeoh9Jq.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\boo8FP0AhS3bBXLUBRbBJy9i.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.944616365097667
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5dTRdM+WOIkdan:fE1wkn23RHM+WnD
MD5:	E3554E2B09E905B91BB9892B4DD6D142
SHA1:	3DAA07301B88F936CDD643B76E6281384BFCA77F
SHA-256:	7084013E4344ED7F4D73C1F0C05EC73CF496D05AD499B8431A0E221865EE43E6
SHA-512:	6A32897FDAAEFEF3063A2B3C13F3EFFBA2077478CE4FE8541F629C37C774B31C4293AE6DE460653936DD254369973A03A13160C3FCBDED7AF5C223A4369F0E51
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\x6grxPSTyIeA8EPDMgptrwYO.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cioAsxrEgULT6QllewrDjFdd.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5PeudcvtNsn:fE1wkn232udcvtNs
MD5:	D4F2D3FBA92AF3A2E2EBADEB03AD5440
SHA1:	90E9D90C525C143A1E2F6EAFF9D580FE13C124A4
SHA-256:	DCAA01DC08614FBA4928CD3BB3B7A257827932C34B77C86E503B46539D30A569
SHA-512:	D76C44DD5AB1734F8F405CD44FF92CE75FD7507A411C89C68EEB9D4BA3624BC821881246B07534F1A10C79AAEBE802781CCFC1241CA256519B2A63D12F07E352
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\jPR83WX1aF07mPj541WJbft7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fCajoF0uziKOHWOtsMKiSmkf.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.818760421130474
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MddpyuPyMJF:fE1wkn23MtyuJF
MD5:	C1A3600FF64BABFD9D6318762D8796ED
SHA1:	6F74D710AED480C58C35666B3488C238DC624089
SHA-256:	8751BE61191D0F7D86DF260683221969A80A9C4F9843A112601047B0B90F3C90
SHA-512:	5703E9C8D2C0429C96D2AF03E03D3E70E7C1ECA9E3E3D5D4258DAB5CA3C00E8161A9B3A37A417458492328699B7EBFC210DD3932A541CE205F80B0E9D9FEB03C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\iiOuEJn1yBaeJOKc16avXLXi.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqngqO4IdouWvJHIpDnLTPg5.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.976075681598201
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cLlfdYWm5Fn:fE1wkn23cLDw
MD5:	73ED654913554AD55E66B9EBFC1D0FFC
SHA1:	3B47E5E1B39DE02D1B27D8F78BF2210238CA70A2
SHA-256:	CDCABF9A665D07C5051742FD9EEDD1248EA88F4AB6C1112AB7C5EA885F82405E
SHA-512:	1B7FEC5311E4050DAB4989AF58CB1B9AA40D6EF12240DE9A17A5E5898009B8D81CBD5E7C92B6B31C548C9B36451532DCA8590E325082CAEDB84C3DA98B620152
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ydXU53ROIY0b9rjoj3B1m3C2.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iV9J0aMa18AmH41d2KxPgrGa.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.008055320037074
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5vtSrt3Qykdan:fE1wkn23VSpgyD
MD5:	4B70D1DB4813C55FB4A363876565ED26
SHA1:	075F479BCAE23B0EC04A0223F76458ABA88C2891
SHA-256:	85C4B684B86FAC26DAD1A438BA74500F639747D134FA0A521E8E94DC84EE79BF
SHA-512:	557E2EC680136F3718F53D4FC3F840969669AE46223AB303F028635D62B045031151A1EF94B3565BD83E4277E8B43C2AA44D1DDB32C9A1EACF8C382562A491F2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\JeZCwGu4yuVGGxFvnw3BIkJ1.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jC9hytOXxSJLUIWk7OLwYELs.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.920493029951543
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Ipkhv443oF:fE1wkn23I+hv4HF
MD5:	2390FD26BCD1BC40D1FA85E43F71AB1B
SHA1:	9BC62B2F6D8B80F890EFEB68F5557BE2C4284A61
SHA-256:	F2C445558CC7881F7C2ADF4AAB3DCB44F7FCBC1F15BE01A6D52DD5223BF4EEE2
SHA-512:	98F007E60EA2156CFDC9F87B3EFC32A5A2B4CF70449C26919216983AD1DE9ADAB269AD73534D28102B9B04B92BEA6E07831942406FF883F09E861C187C812C84
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\mLelSKT2LDJXIBhhiZbtJLRy.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\k2JDJYYF97BxDjJvdjfGyjtZ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.938912508890666
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5hVTJDjf1T0em:fE1wkn23DTNmem
MD5:	3544206DE938E40320F70D9104DAC987
SHA1:	19882E03D165F2B4595AA0C0D3ECF52547D79AFD
SHA-256:	D2B0ED00404D315F95B7C69898A1AC18DDF846D7B762BBF3D752ADED04BB25D7
SHA-512:	64CB41415EAF475FC4A7DEE7FAC78B47F7F3A616979E1F7D2957E4A02735A06FCB54433C0122A1511BF0188B9D443716BFE5E43C4478150C099F4E2E2704C0D2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\D0v59fae1RRLyzPSbsQoGGZK.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kubdYrhB0F7KtjUXb85yOtnD.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.865791037041147
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5uF/HkUJL4mn:fE1wkn23u1HNL4m
MD5:	D38749039D7A559B3F40C8328993309B
SHA1:	5CBD72A00372BC1B1DC059EED03AB771E46F83C8
SHA-256:	D917685129AB7E29BB20B410A9F19645D6EA30E08150786B7D54FB4F77DB4C33
SHA-512:	D8F9DB6E2A8ED1E91B09B9BCF082DA04BEB31739C75025BE5E6BF045ECF8FB263CE4C33658A5C624F3F24AD95E302085DFF5C66BE97FF9905E7AB8FC8CE79425
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\KZrOTs6FcYbq3nj2hpYsaJil.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lnqdr1oc3vWZb0AM6GqrJePb.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.037882384590816
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5B8iH4vF:fE1wkn23eF
MD5:	448E44C116955CDCDE9193EE2BBD9118
SHA1:	23BF1974A51BA2BD8216769EBDCCD3571C09E760
SHA-256:	572A0B28296C282AA9D0F304BB8F242619C9A3371817F610E194C19FA657C47B
SHA-512:	3DEB99E8340F7F9842D4A60F7B902E36A4788E61CC89BA808216703058B8454219C42D24F3784EBF37A7B14AF9F5354610F9B039A170802A611BF89BE3A8051C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\dYzlQyYiVhnqA3GhRDFvHDg1.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lvJmufARuJlw0oQi9mXpQ9k4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.961866261433766
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5DVDr3KJHFn:fE1wkn23JqJF
MD5:	FF09A36941705506B5EFFEB79D72106B
SHA1:	3A4AA768FD19EA9F00EB8F690D2FA8F0E9BFD2AC
SHA-256:	88EFFE11461B8581EF4487CAE30A8427432488A5F81CDC98E4B324599F119FE5
SHA-512:	789354A825A7839C7AB437BC47852A8C5E7E08C676EDDCEA2C4AD7817A2A17CFE142607F8D2C9F947A9B775013FE33772B646D26309300B30155BA7BA3A634A7
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\f0h4XS72dTppZnfmwBjhUBEA.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m35TgMK4wpj8LJ6jgGf2Xw2Z.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.778834515302018
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5rcTmDpGQAdm:fE1wkn23BDcQv
MD5:	CCDA3466887E9406E299AE01A972AB9A
SHA1:	FBA7AB171AFF76249F25CA29B689C439F8A29BD1
SHA-256:	DCAAD3745B98F4A61C61D5FD11DAF4597EC9C1EC72BA8D6433B0FB7B194CBB63
SHA-512:	C63F9D3E11083F0649AA1A2C3FE5B42FA83DAA5C56DD5799D27683547375D702981C92B87B3E6BE832EB0825C24955261154ABA6D4B20381B181DE7FF3FFD336
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\N96vu2CQjxii1alDjKixgxro.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moQfGiqyu6YwVfcrFdZJ5YnD.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.944195523044294
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5qfQ1uwNWtthkmn:fE1wkn23q6uwN47km
MD5:	6C429A440A57158BB1B14649468AE95F
SHA1:	835D75094802DDAB862424FD924D7BD2394F14CC
SHA-256:	EED95955FF211D2D8F97104799116B11F9F0FF7802FC0E2E83D65CEF552BA77A
SHA-512:	3573B236B667DF63CB16F5B6CF971C8FE9807C5F8B04CC092E8AEC1E541ECA7A533EBF2B7684D7DD197F9E2C05D64E08769D6834038EAD281D9B89E27AF85E6C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\OzuxsP18idUhxNQxYYbIiZFx.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oihjzJdDB6SwjKqgn4xLpgF2.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.83680552979477
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5WMSOqlhrpEBJF:fE1wkn23WMPq7SF
MD5:	49F5F472CE9FA5328DCB345E60590CBB
SHA1:	2BC1E628E7B8F6A54C007CA20EEBB922C3C88071
SHA-256:	483816855E2B57F9AC34DA2C0014B10E0081A3544FE0EEFDA0F6506847980E3B
SHA-512:	3B876243535E4E29405A8B260C11231D94D85D96633093C2DD18881D1025834379CBC0B457480DDBAABC410E06A2441F90E74504F187F75FC827C2FF5AFA1D8E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\si8fAgQZyD6Cx4plDNMQadak.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\olGMw8ij2FLh3ZKyyQztgUiZ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.968970971515983
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5USPR11Tq0gL4iF:fE1wkn23U8R11GL4iF
MD5:	0A03A9A96452B6A0B25B4015BE88661F
SHA1:	2B6D29762E2D5BDDF894C4EF9C206F426C447F71
SHA-256:	F060A715AA1606675DB6EB63F4470E1EE8ECB844C89D256F517A73469E4852FA
SHA-512:	72644C24C7F59D1F44CF10572C1D39D2D4CFD775779956C5DC88548B778DE4B720F6572387FAFA743E26E0D196DDB8DDCB6866CE64622AEABCC9C0E5E5EB99A2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\q1Wrkjlqz870PPzT0bIAuAXE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pPDwres8UiyP6hmT2n6yLn7l.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.036367335666441
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5nhRPXzgzR8kdan:fE1wkn23hRfM98D
MD5:	FDD717164E5E1264FAEC51EEFF596E46
SHA1:	882476874193763260C9940EC908578924F91782
SHA-256:	E36688F2074649327FDC8A33A1BBBD32CDEC689A796573BD299472CCE1C9DA6E
SHA-512:	0BED92E32453ED265724775CFE837D84B7714D5A500EB15640E6703934645F25EC19357E53ED752A25144E334CB708063688DF4723E6E8547E8FAFA079F2B6B5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\BScYPWRXjjJsm0UZKd8ZE404.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkqRrg5iWYbcd6JdFTMqN4du.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.985568754526514
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52KIbcmD1VIdyrl:fE1wkn232TbVIdK
MD5:	8822A59D0EB652A6A7F279D1801ADBCC
SHA1:	D9120F4C346FB6508DA7638225E88579B8CA5398
SHA-256:	684EFD076D2153B165EA5251C91D2C9DE7B8067DC999F41ABE28234BBB394667
SHA-512:	425D3C22C02AD88CD5429A210D57BBC12DE2BEF6CA91C7FB3DCC757F0CC6E0BA181DCF17CC3ED93F8C3DFE5A7D14A84B2FFC8D8641B6DD2FAD89D4B6440566B6
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\S8ELmP46wfy25sPQImx4dfKP.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tAZVngHhHPzgcFHrRcS9MvT2.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.76462509513758
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5SGeUXohiF:fE1wkn23SGFGiF
MD5:	832060E5AEA241FE0DFF2E1E6751C5BF
SHA1:	A59918B3F9DA4B345D9D9D25FA3781C776D0F536
SHA-256:	35ECA2F81BEA8D2927F8E0ACB070506609344C6F7A5E335BC3A014844FA2A41B
SHA-512:	B53F69924DB6B7381EBB0542DA06EBBBDD000597DF05BD97DCD82292DB4EC3CBDC8EE2043DDFA4AE0D58AE4387E9E2FC92B48E5B5763B73791172FE91AB79F8D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\7cokQoA6j0WDpV84Xp72tQca.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tlcr68YHXdDJjhyT7wrqm3xM.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.955135921626371
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5rcVf0dRSJrUHAsn:fE1wkn23+0d0JAgs
MD5:	C9BB8F5918EBED365D71503EC58558F7
SHA1:	2DE585A26B7C952DFAC8094C1C4348AECA09DE63
SHA-256:	E6FAC012A1F70FBE59240822E7E31C82DE68FE8FF49176F7DF6EA5ECB140D684
SHA-512:	FE205AB577D41F38CCBA6BCEB2C2CC308F7A4D89E5E30C83746CEC8A650F1E23522919AB1E9DC1E21C82C45446887D5766C0A28DAB7B505DCEA2D135A42D9DF8
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\N9QaRzQ0AfOLtw4JsIq3BGlx.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uSsGDdtTis23IdAFsKMDjhvK.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.898612232787385
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5TBE29ISlUQ9VLNHF:fE1wkn2362GYzVLNl
MD5:	5988876CD52881743DAF7911DA95A3DF
SHA1:	85B9699C3BF7E78EC806F14732C9765B0F455DE7
SHA-256:	7607B22440FBAAF22DAEEB366AA076967B4ED682B33FD4F134AAD3E321DCAD9B
SHA-512:	2CE26DE06620FB98C40880E023A45A49B05E0BE61ABC9FF1C69DE4C8BCE93F907D6C4C9723D85A5851E2D9B3191B92075FCA97C050707A3EC484F3C1A3D378BD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\vRRDKxJPSQaL9EAwTnxxq5Xp.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vr4X7SKAWv4hdQph3V65g9Ue.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.847804770406588
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5UygyIAN3xPyQRN+Idiykdan:fE1wkn23UybrPNN+IEyD
MD5:	5B3CAFEA753D02262382783E2E9BD99D
SHA1:	BDA655F52B74FE1B58772A92752B12333701FB71
SHA-256:	6874A267B78E75BE807092B437AE5E1A545BC7AF59A56A2175B065B827A7BFCB
SHA-512:	104CEF5181F2AE3A3853A97C2B473B175272F6B240C9C991807D2CD32DD5A118C633C9BECFC25A75C4C727413544ED8DA0DF7B70E8A9909440275C1A5911CE53
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\qWJzemjmehRTjWu4hQlmexeK.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wgrTK4F9BP7bp4UxruSjPthW.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.003613863190813
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5SWsCsMXOeUV0Cl:fE1wkn23SWsFMeeML
MD5:	FEB70876557465013DD11ABA57B031AB
SHA1:	ABA7972A3A136B25FE61B56BC5778E563B683755
SHA-256:	0E3B404989748EAE51D831576BE56CBF9CE4AFA0303269CFC2ED4FF04CE8B24F
SHA-512:	0AEE11BA17F4FE6AE88A58F6E7AFA489AEB2FF52756D9571C7BEF09C3ECF750E2E9CB7D838B83E3654A278C4F2771E4E1E402292FA47EF7797384640AFF2196C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ws45TNfHbiigh1rlfu2kvwqp.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x3w25VIhwwar8kgq72wIQMdT.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.904269617215837
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5We0GQWL:fE1wkn23W59a
MD5:	7F524DE6F258F588650BA3E4681C9084
SHA1:	BF14FCA7724B5345287C4D49B679708D849EA600
SHA-256:	FD63334F708CC7AE5A29CCBBDF56BDB9C85391F4352F0002BF6E25756FAD638A
SHA-512:	E1C6884B4B9403519D6103F9D0B2EF25C0B95F5DE2040E069D9F312A5DCFA349C9F0C4C061EA8FF050C5E6611BFD12F498C14085F1BF94057D6F154B0250F9DE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\sZo8dt9VSX8cm31TuXOiptH3.exe"

C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Download File

Process:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3265896566842335
Encrypted:	false
SSDEEP:	3:FkWXlHETUrbi:9uy+
MD5:	4EB1892C75102D6D129A88D7D9039A4C
SHA1:	7B2FDEB0B6DD38CED67F7D42FE7B44EA7AED7F46
SHA-256:	FC0F9D39641AFF0934EC0BAE49710820F49B546B6EE8044E65E470F4EAAB1545
SHA-512:	879D6D88B294715D99411D80250DFAEA44BC5E6788D72590771412EC3EEBCC4FD1E876F1FFABC5699FDFD48E950DFE2469D20FA0DD48A61F847FEAF12B47EA46
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................nE.tGK..N...F

C:\Users\user\Documents\SimpleAdobe\8lBOtksKAFB83rUCOP3QmQ2e.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343552
Entropy (8bit):	6.7047176909836566
Encrypted:	false
SSDEEP:	3072:XRKcLCu7bjrfJE0OlCV0+L/h+nPO9lhE6Vh5MaYo8DU06kgTJW7E1LeUOUkEqiQJ:EEbj9ecVRL/hHVhVJ06fTJpfq0zxJL5
MD5:	540F70094794C16274ABCD644DFE7738
SHA1:	9C644CF30F5BB34E824E2C73A761AAE159900547
SHA-256:	0DDADD676CA7814044645E7E230F25A9E1BFEF479582179D22AB4A26F962B5D9
SHA-512:	20206DFA3F7D4A144B2158D2FFA7F101B95CEA396D377A4DACE47CB010C75B1F3E5FE79065A2B03DAAF4EB98EC43A01AF7A66E89A2D8170B1CB9970D17C675BB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....T.e.............................g............@.......................... .............................................t(..d.... ..p........................... ...8...................h....... ...@............................................text.............................. ..`.rdata.............................@..@.data...H...@...&...&..............@....rsrc...p.... .......L..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\BuKYLuXtWRFvMUw4E6QMnePB.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	318464
Entropy (8bit):	6.547791907799988
Encrypted:	false
SSDEEP:	3072:kpmcLlzbB0rV5n7CzvfHT99+nPGEl8G2TQVWyS7xAYjhMp70nFXXa6uF4W6vc2m:/qB0772v/T99oVmA370nFXKXF4W602
MD5:	919F8F761910803D4FDAB592DBBEE63C
SHA1:	819C861043EA6BA0D69D48A56E1F8A0C295EAF83
SHA-256:	FC1D13A97211887DFA7767DAA27817C1575834899D9F47A674F81D288230DF6E
SHA-512:	69E13430652A6855F9CFA4DF964F3BDEBADBFC8D405B06330706E7A273A5D06B34836864EDA4B792FA46EAEF1B7CED10F7C2E024C7F9E09B329938D511D481EE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....Z.c.............................g............@.........................................................................t(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data....\|...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\N3dNHH1i3277Gfb9sVdhVcr5.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2188562
Entropy (8bit):	7.94338433261686
Encrypted:	false
SSDEEP:	49152:CvxfXTFb1TJDfeQ3ZPSdivgGasStYLXbCKsVZ4:CvxBzfe6Kdi4GasoU2KCZ4
MD5:	309E2C38AED62655F7CF09CFCD40A56A
SHA1:	A235B5E71D665DDD520443DBA2FD42E0F89E3FDF
SHA-256:	0B9A3732229105BFCBFD661BAEC73D588F4FE63F1A8F5DE162607874737DC0D4
SHA-512:	642354A2A0A475AA979E44C00198761DB6E3C0C10075C8D4F44B6B1F43760C49784D9BB6ABCCAF18E0F7CE762CD931708AAD572C87EEDFB03E821749E46CC09C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......#.=lgwS?gwS?gwS?..?jwS?..?.wS?..?.wS?...?ewS?..W>twS?..P>qwS?..V>UwS?n..?lwS?n..?`wS?gwR?ovS?..V>AwS?..S>fwS?...?fwS?..Q>fwS?RichgwS?........................PE..L...`..e...............!.............m............@.......................................@.........................`:..4....:..P...............................d..@...T...........................@...@...............,....0.......................text.............................. ..`.rdata..............................@..@.data....\...P.......:..............@....didat..x............J..............@....rsrc................L..............@..@.reloc..d.......,...,..............@..B................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\UEaGlypujmRvmbw2BfkfATn6.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5077008
Entropy (8bit):	6.713226173072206
Encrypted:	false
SSDEEP:	98304:AZ5VfUpCCTIDsAi8LXS2vwJ1EbfdOq5elO:Axf8ivmOfdOq5elO
MD5:	D15459E9B9D12244A57809BC383B2757
SHA1:	4B41E6B5AA4F88FDF455030DB94197D465DE993A
SHA-256:	37AEF611EC814AF2CDCFA198E200CB21ECB46CAA30F84D0221A47DB1265B889D
SHA-512:	40558644CA9918B84A9438A3A2C4D85A97DDEC378AED23756E14C57351D4B4C82D6316ADD1E62243826328E42C766784CEE5D6CAE41C6FA6C43864F5097A239C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rs... ... ... ...!... ...!t.. ...!... z". ... z".!.. z".!... z".!... ...!... ... ^.. K!.!... K!. ... ... ... K!.!... Rich... ................PE..L......f...............'.....:........:...........@...........................\.....E.N...@..................................@$......@..._....................\..............................P$..................................................... .........l.................. ..` ~............p..............@..@ ............r..............@....rsrc...._...@...`..................@..@ ......#..R..................@..B.idata.......@$......4..............@....tls.........P$......6...................themida.@8..`$..@8..8..............`....reloc........\......xM................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\YEB6goJ_QRA9Ek_PBrASrKDk.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	303104
Entropy (8bit):	6.1282620196226825
Encrypted:	false
SSDEEP:	6144:5pUtp57JgcC9umP9mQwFpaSPBu+opYh/MLlRjdV55Y14PLckdK:Y7Ydfbe8uBuhpk/wd5HjVg
MD5:	3920320ABE977A8205C64894CA6C7E03
SHA1:	C7B79862B48101986F1CB72F4298055B4238C617
SHA-256:	95ABB1FF23E79D1CCB8A08F9802FD8D3358F2F7F6895494F06EAD92AE39AE0BA
SHA-512:	AACD03DB1EF36B6978632DC2E3E1F3A2DA82576C15750E8359238CB104333BE7F9D2C8B3D4A12BB2A8DDA1CD69C7F6149A77EC2C09197C219FF8B657DE72DD71
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....b..........."...0.................. .....@..... ....................................`...@......@............... ..............................................................<...8............................................................ ..H............text........ ...................... ..`.rsrc...............................@..@........................................H....... +...&...........Q..hd...........................................0...........(....&.s.......s......o....o.....+B.o.......o....(.......o....(....,...(....&+...(....(....&....(.....o....-....,..o .....,..o .....,..o ......(....".Np..........dz..........v........0..........(....(!...~....(......&......................("...V(#...r...p(............,...%.r...p.%.~....ri..p($....%.~....r...p($....%.r...p....,...%.~....r...p($....%.~....r...p($....%.r...p.%.r...p....,...%.~....

C:\Users\user\Documents\SimpleAdobe\bLSHn6d_smbEd3DDHsdhdb9F.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427520
Entropy (8bit):	7.797594308720963
Encrypted:	false
SSDEEP:	12288:4+Pv3L1UTL073jVoHfO5jN/maLPXjh6np3:vv3L1UT473jVo/KjEgPzs
MD5:	CD86BE81DDF241013BE032803530DDEB
SHA1:	D84462A3AFB848584ED6E871A3EE02C3213C2C08
SHA-256:	956C0FD36C2F21F37B8782CAA8E5F337DCF9083994C28080D2F42A3A2CFCDBBD
SHA-512:	2779CE00849E22ED68DFA653CDB782C650A0126C3603409610E0499652A72ED0D1635BC3619A93642A49635BFDE672428809EB032587F9D458ABA59BB466FC57
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............Y..Y..Y...X..Y...X\..Y...X..Y.9.X..Y.9.X..Y...X..Y..Y...Y.9.X...Y#:.X..Y#:7Y..Y#:.X..YRich..Y................PE..L....l.f...............'.0...\......g........@....@.......................................@.....................................<...................................p...................................@............@..(............................text...K........0.................. ..`.rdata..Fm...@...n...4..............@..@.data...............................@....rsrc................r..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\e5ADH4rW9PcD5gtgsREzjuVn.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334960
Entropy (8bit):	7.705013280320618
Encrypted:	false
SSDEEP:	6144:xSK+aNVSVLZ/ywJ5aOiaQiNXnVdLporfmjhax3aE4pX:xSK+pLwwAipVdWcAx3t4pX
MD5:	B0192DFAD5381F844AF4C3AF42D9EEB6
SHA1:	5C31358537ACA2EE1BCF759F0580B60A1EB977C8
SHA-256:	7F9F67D56A0A49554BB85641A21554A478FBDCE19AC853E3447FDBFFD1DC5434
SHA-512:	A6F08297744929C727E1DCE302E189AAF4ACE1553AF396F2CBB3CC8EEA1876CB9CCD18D226D036638A042255AA0CFC94CEC0B1801A69F36B6463A127CBE8B927
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C.N.-.N.-.N.-.....D.-...(..-...).Z.-..$(.h.-..$).\.-..$..\.-...,.K.-.N.,...-..'$.O.-..'.O.-..'/.O.-.RichN.-.........................PE..L..... f...............'.,..........c........@....@..........................0............@.................................D...<.......................p&...... ......................................@............@..(............................text...N*.......,.................. ..`.rdata...j...@...l...0..............@..@.data...LN.......F..................@....rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4825088
Entropy (8bit):	7.363795425961208
Encrypted:	false
SSDEEP:	98304:dPwGDPsMTm7Gh0nUu7TcY0mmdlv3GLCjcKbbygH:dPfDPtqGmnUu4mmdlO8bbyg
MD5:	15A5A210A88D15A932171A9FA25A1356
SHA1:	7F6290046BD9BB6129AF3DA4612FAD50369EDA09
SHA-256:	6A92C749F157EC43B1D14CFBA29F9CE164ECD3048353A720089F872F13B843FE
SHA-512:	6738CC6366DA9561DF4B87F099BBA64E56DB7421598C2DDA25BE2933052BDB7593B7B386671F222B1E509A73F54CA982FEAE27FE22D57B6AF82A0B30FFBED258
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\iTHBJLcts9pEuoqVNgU3srbu.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6...............P..ZH..D.......xH.. ....H...@.. ........................J...........@..................................wH.K.....H..@....................I...................................................... ............... ..H............text...4XH.. ...ZH................. ..`.rsrc....@....H..B...\H.............@..@.reloc........I.......I.............@..B.................xH.....H........p...............q....;.........................................6+.(.)lj(......:+.(4.Uj.(.....V+.(xU.I..(....8.......B+.(...<~..........6+.(K7QO~.......0..........+.(..hS ........8........E........5...&...8....s......... .....9....& ....8....s.........8/...s......... .....9....& ....8....s.........8....s.........8........0..+.......+.(..578......8....8.....~....o......8......0..+.......+.(i'Nb8.......~....o......8....8....8......0..&.......+.(.\J>.~....o......

C:\Users\user\Documents\SimpleAdobe\jQql7MG2XChbxjQ6gNLJX8a8.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6153216
Entropy (8bit):	6.377641735642354
Encrypted:	false
SSDEEP:	49152:W/Ce4+1N237v0gM68DXYDqwLvws0EdRGtVpT1kTNkbNbQWSxR9DzNJyEv5j/ujOJ:je4PLs6VKOQpyJWSxR9vBEAm8dJT1
MD5:	817C11005CA185252E666C25769A2591
SHA1:	E52EC29D0E10C63B378B919FA1F5839B714BE07C
SHA-256:	353ED3726F653A8E19C5C1511088AE21F3673D992A1781C100DEC7E8418A7FC8
SHA-512:	B7CB060C4CABBB926E8A40ADF797F9B082F6BAC87A97B984AA6A636D82CF873B5657026B43D17359FFA1CEE1F9EACCED591F6C03E747B3D63090A4BC3D0FBF9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..&...]................@.............................0d.....}.^...`... ...................................... b.N....0b......pb.G....@[..............Pc..............................,[.(...................\|4b.@............................text.....&.......&.................`.``.data.........'.......&.............@.`..rdata........,......\|,.............@.`@.pdata.......@[......([.............@.0@.xdata..D....0\.......\.............@.0@.bss.........@\.......................`..edata..N.... b.......\.............@.0@.idata.......0b.......\.............@.0..CRT....p....Pb......0\.............@.@..tls.........`b......2\.............@.@..rsrc...G....pb......4\.............@.0..reloc.......Pc.......].............@.0B................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\mglK9j1udRLIlNMmqHDs89S5.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396432
Entropy (8bit):	7.971776651930106
Encrypted:	false
SSDEEP:	98304:CkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDK:zZ2x3CqNcHdGTLNp+F+8elDK
MD5:	B771700D69018054DD943B925FEA644C
SHA1:	4E2F78B445F72BA9047E1C3B04D3038F02EDBE44
SHA-256:	D17AD1DCBAFC3D794863720E3ADBB64FEC117549A51858DB3BE7B7B7F3BC63F9
SHA-512:	5FDE1B9785B13073394F355F627B28932AA436A50A9FC4B93C8F6E2E2BC92CBFA00479BA23339F67D7721BBFF5A0EDDFDCE471C00FD9BC6D6BB27E7E93AC4F32
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C............. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\poDcVPAkLsUtWqX_rqUuGuhg.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396424
Entropy (8bit):	7.971776907219028
Encrypted:	false
SSDEEP:	98304:6kZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDv:7Z2x3CqNcHdGTLNp+F+8elDv
MD5:	B8A886917F1F5AC4B6B6D85592BA5FAE
SHA1:	F79435A483AE68FBC7843F599721429B53D67C1E
SHA-256:	581D748ADD7C355C0B9A75A8E2FBBE1D9098562C57E05BDD2F30EC45AB5B5390
SHA-512:	7F37566F8DEDCBA66E12C012E082B4A7DF53D767F78525CFCE1C59067921B8ACB756C7496AE74F8B742393F0DBAB48E32E63A1F23621EAEFDA4EE331E1F1589A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C............. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\q8kYHwm3PccnSPsq8WHAVhzd.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines (17875)
Category:	dropped
Size (bytes):	282582
Entropy (8bit):	5.1389896399970185
Encrypted:	false
SSDEEP:	3072:qMlaKFywUN4tbNLaCzweCRs0xxkdlNY5ZOTHg0mRU0ebgUynIY6/uM:rg4TLaiCRpxxCl8N0gjnIY6uM
MD5:	E5EEB84A66D07B6EA15BF94F9489BA80
SHA1:	435036A68DCE20F46465528B857D3F4894C5B55B
SHA-256:	B7FFA3898D9D6D007BD1191E332B62854E7B5741B2D4E5BF38DA39350F1CCAD2
SHA-512:	31DCA6EC89BF8EE7E437AC2B91FB66C7A069ECF5BEEE6E042BB90715E9FDFC9228EDE9B6C9F95880005C2957C54598EFFFD68415F7B1F9AFAB511F69CA8A2EBB
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace(

C:\Users\user\Documents\SimpleAdobe\t1TVh5wiN6nn0UU6UNFGbozD.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines (17875)
Category:	dropped
Size (bytes):	282567
Entropy (8bit):	5.138802974250197
Encrypted:	false
SSDEEP:	3072:qZauFywUN4tbNLaCzweCRs0xxkdlNY5ZOTHg0mRU0ebgUynIY6/u2:Z4TLaiCRpxxCl8N0gjnIY6u2
MD5:	C88816BAA0E5480DAAA3DBFC3847913F
SHA1:	988E8A197EF8CAE391E5B891873861A688674643
SHA-256:	D1C2408EDE3E9A62530C2EA6DE63A0E4AD720594EC44C44170A0081511BD05D9
SHA-512:	5A2129D3744013773E144EC7F527ACA8414B3B1AAA599CE3C4E4883741FE103957700BBB17ED7D263B64D02B72691BD2461EA0D73EC4C85C7B89D4EC09F85BFE
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace(

C:\Users\user\Documents\SimpleAdobe\tk993DcPKxGC0yxEJOpWA4Uq.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6645997
Entropy (8bit):	7.9960820227785065
Encrypted:	true
SSDEEP:	98304:91Obp2zjJY231tFaCYTlZE1JLFSNGw6eJm5JeHxFKw7/X26jOnCB9XmtPtX4S8Bf:91OF2zjVpYD8vDwJmaHxbS2Os9qP0eEV
MD5:	8433EAED37248E24EB963A444E5E1EED
SHA1:	8D004418690587FC541547B2D0EFE2CFD629FBBA
SHA-256:	7B4A250930BECEDC17B8D67DFEB39EE143B03466E85D2D77282AA52014BCA196
SHA-512:	8656B020A34F6300F79675954DD56587E7678EC46DE92E53FC945E5FEFA476504761DB0FB0AD6F3C2C9F97D52CDD3767399EB8FC8655BCE5E77C40C1BE99BF56
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\xFUB9mqMmDXHB6bYEudfe3bz.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5132515
Entropy (8bit):	7.9989710005062715
Encrypted:	true
SSDEEP:	98304:edvpKKEk7iDhtjYagGe5e5Nbx0U9WNuKnLYUhymVb2:ihwYiDfjgQWFLphJC
MD5:	F7900D3A6E3F0A09BA62AC64B9290B34
SHA1:	A48992FBDA2A879AA3A03D2FB319D4975EDD218B
SHA-256:	8B0BB592AC99DC7FFBF70BFCFADABABB7BAD4E7AEFC8C8E965BFEE66ABDBC8AE
SHA-512:	134C9F8276B9D48FF0C174D61B3618D7E52852C6BC7AE08146B352E7476BCA0F5330BC712D89F207E2443A956C809FDAF46F390DDD1A5F8C2FCBA2670D445070
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B...................@..........................0...................@..............................B........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..B...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\zfmWdTyj1A0x7CDHTSCFc6P6.exe

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.544910731342647
Encrypted:	false
SSDEEP:	6144:JXkws5FHvbaXTLC42m+g51uHct7jGZyL:JUwsvbaXTLCfg514ct7aw
MD5:	867B7D371368F7872DA473E89646AA0B
SHA1:	632E18C92F4E304DFF18F8C6ACFE165D7F5F538C
SHA-256:	CA3CB9514C8544017CEF8E68C76D4ABBB7028019D2DB0C4AC4D88C29700743DC
SHA-512:	D5B492E5B15264F47F4C811BB0BC7584C3A914839A2D1EF962C217E6091203C72434EFB2D2100097A75B8BDAD007B1EC2A6849D51839BF1B23ECEB47802D1E86
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L.....Ed.............................g............@..........................................................................(..d.......p........................... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data....x...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884127351666352
Encrypted:	false
SSDEEP:	98304:J0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwo:aPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5:	CD54757EAFA70E59850F77982FAFCB49
SHA1:	C339E58CD44295099CFFD1AB783FCC65A5A9913F
SHA-256:	39D50F4716DAEF3C7B75E4DE57441390026036507E9B1676A927B85808BB526F
SHA-512:	94B24A1E28CD7FE880C2CA6AA21DEFD92CA2B6B5000208A5F8528E4DED777647616D44818C42257C8C6C5F2B95BDE8C484DFE8AF5DFC0DBB198958F93E7D6D33
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\0oplAGcqdSD8dY40aY8KDRaa.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\4zJ5E9cuigEXwPfwJBBf2Voo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\5QOOoyFK4iimcVizzTfwyofF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\72ikwo0xN8m7DIEmg8FL68i9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\C3zBXysGYP5W2fmci6hd0XEB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\D1DNzbYhZ5irlEMiXjcU2a2e.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\EVcXAn6aSSI07ttXmnvL0m1a.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\HmEe3wDzeiBBjESYuBab3Xp4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\IWT1vUWgcWghP1zoHHmuoKa9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\IpPaPlW8SuKj6HZ6PbpzdKUK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\JsR15JaJDFzaXbSvvkMXKGOy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\KAKoKagL31aeT9tvPuu3L1bc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884128419820281
Encrypted:	false
SSDEEP:	98304:P0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwh:cPMki6zio75L3pf3dedO4keCIwkoYbgB
MD5:	5E71284947BF8E2B1B90B843D650CA13
SHA1:	9C52DC35DC332632569056816836B747F73BB238
SHA-256:	436FCD6CC8AC3A9761939819D7CDB47EEF995145BFDD7BB5A3FF302414878875
SHA-512:	DD8989FB9E67D704F4F562C6D12398880690E1FDC27022F705470EC273C85D3965E0230203576C564F50C0BEC5EBC7F870CE2A665EFBA4A8E0ACC78215B1D2F0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\KlC0MO7JlENai4lmIm0fgxCd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\LLoAVhqqC3TlPmj3xeFbhIJr.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126803368091
Encrypted:	false
SSDEEP:	98304:f0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwg:sPMki6zio75L3pf3dedO4keCIwkoYbgA
MD5:	47EB5DBC3AD1B569D0776F4CBF111342
SHA1:	7C4A9800EAD26F628DE6C2E978242277BE707960
SHA-256:	7A23897DCF9E267246C03EFB73C166D9D9B90B42B1913F87F3773B807581C3F5
SHA-512:	AC33DDB04428CF35E519C4566DC4A63746600B1295F36942F26BD2E28C2E619AB031E5985BB7059BAB2B92F97728EFC82C30E81F1547CCD8ED4A68132966B78A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......(S...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\MphEWivXVroFMrkzyLgmuj2t.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\OwiOgmO3oIyIM5MtwxyFTS2j.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\PMy8rA40PiG6kLCCQ4O29elX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126021626081
Encrypted:	false
SSDEEP:	98304:l0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwZ:+PMki6zio75L3pf3dedO4keCIwkoYbg5
MD5:	1560C8B87E585F41D68CB050AE0CF052
SHA1:	6919DDFE2A4475883092257E9B8B12DE0811D1FC
SHA-256:	D22C0AF0FC10A88FE2B59AE051951EB6DFF323D7A4C145C80AFCD69D9FD52A02
SHA-512:	5E645243F8E44E28CFF5113B683ED97713DCCB56A6DB1E8B13905FEE9007C76B177F607E0343C69B3D8FC0BD0899D8C515FC86E5EDB985159CC4A61BB56C1B13
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......HR...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Pn5ZHf0b4pBQKwEbywjz1WNa.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Q1ZjqgqRF9GO7rx2KZzJIL2b.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\QKDjQ5sBUXPsok7hLKm8Jxa7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Sj3OVhjmKPY77wuH4sHs0IWD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126316660053
Encrypted:	false
SSDEEP:	98304:90NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwk:WPMki6zio75L3pf3dedO4keCIwkoYbgE
MD5:	EF199316DF30CB4E02F45F156EC63A9A
SHA1:	1D01117469FE286CE64CD27DFCBF939DFC7E8F22
SHA-256:	858F0951DC8F6A15014CE367AD4CD4274D93881AA5D0B101ED524389CD25BE3D
SHA-512:	F7BACAE2D24E570911358EDE0B56CC0A94713A1CEBC47BBCB9D83AAD3B357F7CFE5494C0CF5BB2972542F469B9538BAE0F9100C3BBA918DE71040E9FED8C5A9E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......\R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\UIlweOQ5afwPPuh3ds8U6N2a.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\UZEIOb5AJt4PKuFpMNcUE5kB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\VBK0acBbP8jSA9iTV62oCIGo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\VZQMh0fhaUDqSIPOKlnYI2fB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\YFF0xQcRAUpBPwLPUp2RM5MU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Zo2cLek54856t9hHiM76hOvA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\aTkqzhHOj7NgaroFiyZu2tdl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\bxrHv2BMlcULxp3nGjO9PIeE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\c02zgoz7VFjrBiCTIiJdXKzh.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\cvz8uTBLcjJDrWiUkH9ou3st.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\dNJx8I5qbjWEp5UtzqYCiiad.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\dTzJTeCvH5akGV8vPoopaG4c.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\dhes16NzxQrsGp1NLOpKhYEG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\exiuFZUeNjcDMo0MgYdiT1SB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\fBaSCDbc3PgwiKtKElJM21wM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gRYJFiU6bkvQhx8faYvTd9ih.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\jvm8OUFmYtzvgwR72YgLOVLo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884125378117049
Encrypted:	false
SSDEEP:	98304:/0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwy:MPMki6zio75L3pf3dedO4keCIwkoYbgS
MD5:	B1D3A17EDD5DACC6B98BEC740C1B4A2F
SHA1:	9E059C6CE6AC7E32D848B29026C34A5D0C1599F0
SHA-256:	92A81D1CF0DADC90DEA8BD297EAA153A755B3B972D77D141E39C03F76C2D8B28
SHA-512:	3F9914FE9C10AB719814BEC9625D2BF3F0A564F814FF6AFAC082BEB594D14831640BB2E59A3CA8B1E7F3E9AAB26AA4A416D25C11A752858202B02625995BD505
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......S...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\puSUyQPbhGQYc8ea6l8rcmDp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884126544344988
Encrypted:	false
SSDEEP:	98304:d0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwD:2PMki6zio75L3pf3dedO4keCIwkoYbgj
MD5:	69E1ABABF2EDDB10050CF8F77602BBE5
SHA1:	FD197C40FCDCB2585295FB1E1A3E7D81B04C65B1
SHA-256:	7F6DAE24C6A7439C6894CA16A7376D87DE4CB64BE83CDBBE24E78AC7B9F9D749
SHA-512:	42499B0E2E2BFAB62374142BC11A664B24ECC160D2980510B17123F139C8F91DE504F39BD80BB244EC0365A200D3FAFDCEBA0077A69D774EC7C4FAEC83A14236
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.....MHR...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\remGzM3ucI0rwNvHqGHEYSnk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\s9S2YPHvXa7oseKyop7fDJGM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884125904829497
Encrypted:	false
SSDEEP:	98304:y0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwww6:HPMki6zio75L3pf3dedO4keCIwkoYbga
MD5:	611A07F1F59CB67D20A7609D6444442D
SHA1:	31B42E9431BA12416B2336E83BD0730D35790060
SHA-256:	854BD34503D6676B526FF736B40FB3A65A2C089C66D7728BCA417E699440A049
SHA-512:	D948E425E7BDCDC5C2AB7C0D7D60F133A964BA90F58DEDD5060A097F25D44B87DC3E5CD0DF9DAB378D46BC11AC206830F0137EA15A8CC17F99A4AE22A2B13055
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.....?.R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884124407997752
Encrypted:	false
SSDEEP:	98304:k0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwww:lPMki6zio75L3pf3dedO4keCIwkoYbgQ
MD5:	C2F0D0D1B405D1F1476B802BE5DD2ED3
SHA1:	CFC0651E0B9000018D138442324FB2D4555075E7
SHA-256:	36A67B04FA544E6C6E2F33A5A837050136ED30360AF0FC3F96868D14F717487E
SHA-512:	5C930F51A072936B7817ABC2A896DD06961422709D2530C35330B6F79FD0926927AE90BA2F98B6F4CBB8237457473EAF3D5CD32E7943D44CEF2DE9AD366B9B6C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R.......R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\u7khEnv04mT2EDLzgGnRMGoz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\v2MiP1iSJrMhmInOYy5QW224.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462337
Entropy (8bit):	7.165289332124068
Encrypted:	false
SSDEEP:	6144:52bjG4z4HGToSUG/Xfl+jE2TgEVGuIrsvi6WTQo4PWcvhN/EdLTRLf:5kjGgToSUGP0hxGuPv+MaLlLf
MD5:	3A4982B7D2352FB3089C01B9F33C25EB
SHA1:	A87055A316E5E1227C237E0A44A941F98F583419
SHA-256:	7A0BC7FD96BE7CDA19119D1FEEFA81196225786D98FDDD5E1AB5103C21F6CBC5
SHA-512:	048675D6AA6F99B6EA6E5577D024A7B314D522C81BA867F2E2013D1839DB0D6C0947A1C67E2E5B905B577EDEB153C16D9ECFF6D386E96D59C4836BE3BE967509
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......c.....................P.......g............@................................N........................................(..d.................................. ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data.......@.......&..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6802728
Entropy (8bit):	7.996235974818118
Encrypted:	true
SSDEEP:	196608:91OXbE7giOz8u70OteFI7tfL6TCdPeMLN3IA:3OIBOUIECdVLN4A
MD5:	5D5DA0738299D8893B79A6C926765E5F
SHA1:	B05C2CFD30CA1C163CB829B7E7E5EA2D6C57D1D1
SHA-256:	53C80BEE05D28FE65AB0AE6459753FE7B804C0B68B85FAAF828576687EF28CA3
SHA-512:	D9FFFE943131E71762F5E2E1AD3D23053069F0F028054BE9EC2C8491A6812ADADACBF099AB8FA79CA9916CEDA14CCAEDFE4A0E1E5235871A97145EF77D7B0B26
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\ySa0tmdKXLMzZNFqxzPk3yl0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5388160
Entropy (8bit):	6.884127347307364
Encrypted:	false
SSDEEP:	98304:z0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwww1:IPMki6zio75L3pf3dedO4keCIwkoYbgV
MD5:	FAA5E9B03992A4E6148B799082100602
SHA1:	6A7F81280293B1EE54DFA9E4CDB187DE441A4897
SHA-256:	55067872C8F4490FBD427FBF6209B43E0F22A59AAF2A60F7733E2B1E51AFACB7
SHA-512:	E1671D70469A13216A4EAF36A3752B537A66515A67FFA5CAA4CCBB966F54F1227FAD52115C32C26400CC4C4FC0DDAB47802DA463FA8E70BF1C1BB3B99CB6EE1D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......Z....M.....\|*............@..........................`R......\R...@.....................................P........{L...........R..+... R..7..`...............................8q...............................................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data....4...P.......8..............@....tls.................V..............@....rsrc....{L......\|L..X..............@..@.reloc...7... R..8....Q.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\z2yKWzT0GXgmaQHim8qSwTt8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4396408
Entropy (8bit):	7.971773908633874
Encrypted:	false
SSDEEP:	98304:KkZ2HRjDxUqNRSWw/fdG0ya8lhbNKCN+OMuHRmn++CozeYuDm:LZ2x3CqNcHdGTLNp+F+8elDm
MD5:	281F44C8C6F0CFBC293E1FDB8B3EE782
SHA1:	CB1ABAA337D77C1B8AE1502AE0C8B47027EE7FA7
SHA-256:	72A115F25006EEF0B5762B7EF5E8644D13EB1A42A8D0FBAEEFAB1E07F7B34C64
SHA-512:	CBA42B82A2D84872ABB45975852DB340E8DEAF3F9D965191B0E73B8186D1D2A42C7DD4F74EA1C740E9D0F363285D2E637AB71E51D8AD0EDF6FE7A993B53C8FC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....}.e.....................L.......g............@.................................K.C.....................................t(..d.......p.............C.x........... ...8........................... ...@............................................text.............................. ..`.rdata.............................@..@.data...H....@....?..&..............@....rsrc...p.............B.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\zMgiNzEE9vHMTa7pUx4El30p.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5128704
Entropy (8bit):	7.955603913831852
Encrypted:	false
SSDEEP:	98304:6eZ9klwlIGDH8gNN0/Y1pQtU4bizh9OjA+upZPdA5Jtfzq/sH0aN2CvV:6eZ9owNeZtU4FBuL1A5Lu/sH0g
MD5:	A25CDF843E60F609B970AC9414170A7A
SHA1:	9D0FEE8C64C58D674D383654A4391B8E41D994DC
SHA-256:	109A993670756619DB430191F217236914602B1AAC6FE093E1B8B1887CC3D9F9
SHA-512:	E4DC2979919C8ECFB2A09FD78446DB57483E74FF2E3DDCB498D0718590EF0E9021424D6656822921D41B648A36253E9275045B2E4931F94F00C474B73444C6FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....D........r........@.............................`.......TN...`...................................................f......P..........,............0..D............................r.(....,..@.............^..............................text............................... ..`.rdata..Fp..........................@..@.data...............................@....pdata.......P......................@..@_RDATA.......P......................@..@...N......`......................`..`...N... ..p5.....................`..h.vmp#.V7t....U..................... ..`.vmp#.VP.....^.....................@....vmp#.V<.M.. ^...M.................`..h.reloc..D....0........M.............@..@.rsrc........P.......&M.............@..@................................................................................................................................

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.080093624462795
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
MD5:	8EF9853D1881C5FE4D681BFB31282A01
SHA1:	A05609065520E4B4E553784C566430AD9736F19F
SHA-256:	9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
SHA-512:	5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466208936751544
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b47WSPKaJG8nAgejZMMhA2gX4WABl0uNMdwBCswSba:BXD947WlLZMM6YFHO+a
MD5:	6065478D390B98452BD07343C9965ADD
SHA1:	E2BAD0AA938012302A4E5C772446086C5F6F2153
SHA-256:	6A4C0A5DDE6E53975C56CF0BC5382EA7EE7F844727325597C00383605D3AEF6D
SHA-512:	7556C93AB75C0E4FB9081F1C1CEAE44752CEC735AE867B87AAB3BFD1B0667EDA59326B26D82BA488FFEFF5CCBC1DA338C90E5675587CD34740C1761EA1D489F1
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR*.`(................................................................................................................................................................................................................................................................................................................................................!.T........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6248818765384865
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
File size:	570'320 bytes
MD5:	e1d8325b086f91769120381b78626e2e
SHA1:	0eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256:	b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512:	c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
SSDEEP:	12288:vWcj324ri1mvJnrOj1fiTvwG/APkmUETuegWaR0j:vWcj/rxvJnCj1aTviPkmZLJaR0j
TLSH:	80C4F121B3DC4A2BCBAF03BDA47814211BB0E257554BCB5F5D8498DE1C8BB855F22B93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."...0.................. ....@...... .......................`......W.....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661FA6AD [Wed Apr 17 10:38:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	17/04/2024 12:58:54 17/04/2025 12:58:54
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	0C9100B87B48188A5B9DE050DF4E3813
Thumbprint SHA-1:	489041866D9D09C277FFD4FCD82FDB39453ABF1E
Thumbprint SHA-256:	A20268991ADEB27FD9CCF3A4E4ED4684BC4ABAF20802056BBEB6976C35075C6B
Serial:	00CD8F27F53C159B486BE6F49AD6BA7FAE

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0xb1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89af0	0x18e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32012	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x300b8	0x30200	8e365c1dd04669b4d558fd8e896e5181	False	0.4225700081168831	data	5.998151303617744	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0xb1c	0xc00	44ef1cd16dd1c79a6949328325e98022	False	0.2835286458333333	data	4.2976721856944415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x340b8	0x43c	data			0.4806273062730627
RT_VERSION	0x344f4	0x43c	data	English	United States	0.48247232472324725
RT_MANIFEST	0x34930	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:35:54
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe"
Imagebase:	0x1e7b5d40000
File size:	570'320 bytes
MD5 hash:	E1D8325B086F91769120381B78626E2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2411331877.000001E7B80B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:35:55
Start date:	18/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:35:55
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:35:55
Start date:	18/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xde0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:35:55
Start date:	18/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:35:55
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:35:56
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 208 -p 7412 -ip 7412
Imagebase:	0x7ff617fe0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:35:56
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7412 -s 1156
Imagebase:	0x7ff617fe0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:35:58
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe"
Imagebase:	0x400000
File size:	462'337 bytes
MD5 hash:	3A4982B7D2352FB3089C01B9F33C25EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000003.2351558121.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:35:59
Start date:	18/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:35:59
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\JIsbjewlnghreiCB15kllzTk.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:35:59
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\7ifrWkUACu1QmnINWqs0eu9h.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:36:01
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe" --silent --allusers=0
Imagebase:	0xf80000
File size:	5'388'160 bytes
MD5 hash:	EF199316DF30CB4E02F45F156EC63A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:36:01
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\KI5P6OyhHMwNaNA4w0xtd3UY.exe"
Imagebase:	0x7ff79c960000
File size:	5'128'704 bytes
MD5 hash:	A25CDF843E60F609B970AC9414170A7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:36:02
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\T2RIU3FpH6dczIGTG32vuvvE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2bc,0x6c60e1d0,0x6c60e1dc,0x6c60e1e8
Imagebase:	0xf80000
File size:	5'388'160 bytes
MD5 hash:	EF199316DF30CB4E02F45F156EC63A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:36:06
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe"
Imagebase:	0x400000
File size:	462'337 bytes
MD5 hash:	3A4982B7D2352FB3089C01B9F33C25EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:36:06
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\QHuPF3k4no0JL9DdGqDYtkCG.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.3380053915.0000000004D40000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	02:36:07
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Yz2gr4IqEnTCH1g642bo4hrO.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000002.3312662666.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:36:12
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\3wiDjAuNAMEeKc2Sp8AJvkHN.exe"
Imagebase:	0x7ff788cc0000
File size:	5'128'704 bytes
MD5 hash:	A25CDF843E60F609B970AC9414170A7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:36:13
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe" --silent --allusers=0
Imagebase:	0x70000
File size:	5'388'160 bytes
MD5 hash:	C2F0D0D1B405D1F1476B802BE5DD2ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	02:36:15
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\syLcQZGPHHUJ3M0wbg0XxQZf.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e8
Imagebase:	0x70000
File size:	5'388'160 bytes
MD5 hash:	C2F0D0D1B405D1F1476B802BE5DD2ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	02:36:15
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\wjaGPzkDQjpdcbjBR9AwSFKW.exe"
Imagebase:	0x400000
File size:	6'802'728 bytes
MD5 hash:	5D5DA0738299D8893B79A6C926765E5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	02:36:15
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\SU1be6oqYDorLkUc1l6IPPFB.exe"
Imagebase:	0x400000
File size:	462'337 bytes
MD5 hash:	3A4982B7D2352FB3089C01B9F33C25EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000017.00000002.3372271879.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.3387263069.0000000002F7E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	02:36:17
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Vh2fqCjm9jPtwuJrcfbbwxLj.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000018.00000002.3312827601.0000000000843000.00000040.00000001.01000000.00000015.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	02:36:17
Start date:	18/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5me5kJjaX6nSu3LrmZClhT87.bat" "
Imagebase:	0x7ff6373f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:36:17
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:36:18
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\PqdYh9kiVSkf3FjC9RDfcS2e.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	02:36:19
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe" --silent --allusers=0
Imagebase:	0xf70000
File size:	5'388'160 bytes
MD5 hash:	CD54757EAFA70E59850F77982FAFCB49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	02:36:21
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\T2RIU3FpH6dczIGTG32vuvvE.exe" --version
Imagebase:	0x3f0000
File size:	5'388'160 bytes
MD5 hash:	EF199316DF30CB4E02F45F156EC63A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:36:22
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\0XytwVHS3WE9jtGuuRid6GiP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b0de1d0,0x6b0de1dc,0x6b0de1e8
Imagebase:	0xf70000
File size:	5'388'160 bytes
MD5 hash:	CD54757EAFA70E59850F77982FAFCB49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	02:36:23
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\mm4Q31XfpYKjbn6ceSwXhER9.exe"
Imagebase:	0x400000
File size:	462'337 bytes
MD5 hash:	3A4982B7D2352FB3089C01B9F33C25EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:36:23
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\GGlApx2WKpOBsEMsKqplE6Uf.exe"
Imagebase:	0x7ff6a09b0000
File size:	5'128'704 bytes
MD5 hash:	A25CDF843E60F609B970AC9414170A7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:36:23
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:36:23
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:36:23
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	02:36:24
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\oE07FMGKijbqRxoSOEfcVNr4.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	02:36:29
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\1HakjlIwxygCinOPkQfhRxwL.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	02:36:29
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\F6G6Y5cEUOHQw9dTwu4nNoIO.exe"
Imagebase:	0x400000
File size:	4'396'408 bytes
MD5 hash:	281F44C8C6F0CFBC293E1FDB8B3EE782
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	02:36:31
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\0XytwVHS3WE9jtGuuRid6GiP.exe" --version
Imagebase:	0x720000
File size:	5'388'160 bytes
MD5 hash:	CD54757EAFA70E59850F77982FAFCB49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:36:32
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\kuRSiZPmKhbW1guMqYXCvrAu.exe" --silent --allusers=0
Imagebase:	0xf60000
File size:	5'388'160 bytes
MD5 hash:	B1D3A17EDD5DACC6B98BEC740C1B4A2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	02:36:34
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS2746.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /sQwdidHh "385118" /S
Imagebase:	0xd10000
File size:	7'157'248 bytes
MD5 hash:	E77964E011D8880EAE95422769249CA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	02:36:34
Start date:	18/04/2024
Path:	C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\kBnX25PRDA3FRCf96qRj6qpV.exe"
Imagebase:	0x7ff7eb540000
File size:	5'128'704 bytes
MD5 hash:	A25CDF843E60F609B970AC9414170A7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B889B70 Relevance: 2.2, Strings: 1, Instructions: 936
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y_L;, xrefs: 00007FFD9B88E6DF

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Y_L;
API String ID: 0-493232020
Opcode ID: 51af3926d4304d0e222676d4336099444fc7f8f1816366476b40051dc56cc9c8
Instruction ID: 7e5766a78c30d018719a5224409cf87f8acd5124bdca0cddda1b8b4d2dcf572a
Opcode Fuzzy Hash: 51af3926d4304d0e222676d4336099444fc7f8f1816366476b40051dc56cc9c8
Instruction Fuzzy Hash: 3352F730B09A0D8FDB68DB68D865A7977E1FF58301B1501BEE05EC76A2DE34ED428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B889B78 Relevance: 1.7, Instructions: 1650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e84a36683340bb9494d712caba08cf7457f9e0513d6318203930127ef65e0e5
Instruction ID: acb02db1ba7f71f8acc5a15b09f8b5ac5ea0183273f87f684e2e0ff3e8276c79
Opcode Fuzzy Hash: 9e84a36683340bb9494d712caba08cf7457f9e0513d6318203930127ef65e0e5
Instruction Fuzzy Hash: E8B2C671B19A4D8FDBACDF98D465A787BE1FF59300F1500BAD04EC72A2DE24AD428B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885660 Relevance: 1.6, Instructions: 1621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004702f22199f341bbc4769ac5142bf576734e43ee8826a654e6ea2f077da280
Instruction ID: 0d3ceedc5f94d3432cd7985e1690d5ae61a00a760dd96bbce24fc3d19ba4cbb6
Opcode Fuzzy Hash: 004702f22199f341bbc4769ac5142bf576734e43ee8826a654e6ea2f077da280
Instruction Fuzzy Hash: 65B28830A0EA4A8FEB69CB54C4616B47FD1EF99310F1541BDD48ECB5E3DE28A946C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891595 Relevance: 1.4, Instructions: 1370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2477126baa8f7b7e61a7f07a52ec875da7dce696702540e4a480598ca6e5cd
Instruction ID: a75800dce56d6359d4a5bc724480f0ba33940ea8ffc113a140607259b754180b
Opcode Fuzzy Hash: 4c2477126baa8f7b7e61a7f07a52ec875da7dce696702540e4a480598ca6e5cd
Instruction Fuzzy Hash: 9572793170DB4A4FE768EB68C4615B57BE1FF99300B0145BED48AC72A2DE38E946C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88CDE9 Relevance: .5, Instructions: 522
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4ed0b1fd85c3fb95d316c7aa0a096dfc8c3a48bcca552cc49a6cc1a99f29d1
Instruction ID: 56f7bea3cd8a5421cc146b6a0815b29868b3e328d360f94e5c49ff3759dd9e79
Opcode Fuzzy Hash: ea4ed0b1fd85c3fb95d316c7aa0a096dfc8c3a48bcca552cc49a6cc1a99f29d1
Instruction Fuzzy Hash: CEF1AC3160DF8A4FE329CB2884A5575B7D2FF99301B1446BED4DAC72B5DE38A942C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88586D Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416ae4ee69a5c30026191844f49b8052b44c6a45f4069de5f8f73f733126b504
Instruction ID: 42b8f96729046a75c3fc2b1d2472c631ec80606ccbf6c94fcff8158fbb3c7d3b
Opcode Fuzzy Hash: 416ae4ee69a5c30026191844f49b8052b44c6a45f4069de5f8f73f733126b504
Instruction Fuzzy Hash: 6771B73171CE0E4FD76CEB6898654B9B3E1FF99310B41063EE59BC3296DE34E9428681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B895E1C Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbbeb4e4a92edefe8d79b115dbcae39e638d85722decc8489429b667cf28284
Instruction ID: b387a50101094e4f2dc83475674aa93c240997043e96edcbf380d047ddf8c9c6
Opcode Fuzzy Hash: acbbeb4e4a92edefe8d79b115dbcae39e638d85722decc8489429b667cf28284
Instruction Fuzzy Hash: 2B41583160E78D0FD71E9A3888620B53FA1EB47220B1682BFD4C7CB5A7DC25690783D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B895E69 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da5dd53c2ac88c59700be25c03e648a39f95f2aef2c25fb5e5107d07970e417
Instruction ID: 40a807a139e3a31cef4eae6668ee685909333b7d96cc5df733cdc73d52235515
Opcode Fuzzy Hash: 9da5dd53c2ac88c59700be25c03e648a39f95f2aef2c25fb5e5107d07970e417
Instruction Fuzzy Hash: C3412821A0E78D0FD71E9B7888654A53FA6EB87210B1682BBD4C7CB1E7DC2459078391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884442 Relevance: 1.6, APIs: 1, Instructions: 147
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B88452D

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1f378b9627467f9b17ae45bc619183ca2f5de55e8954f335c2be5375a44f76a7
Instruction ID: e3d5caa5a2b633daed3a8a8f3365b2b35efec37797c65b03ff98260acfe1b708
Opcode Fuzzy Hash: 1f378b9627467f9b17ae45bc619183ca2f5de55e8954f335c2be5375a44f76a7
Instruction Fuzzy Hash: 6441273190DB894FDB1D9BA898166F97BE0EF56321F0443AFD099C3192DA786806C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B960E29 Relevance: .9, Instructions: 935
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2776181309.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448f1b3d937953d274e284ad6e457e2ba05f70b3b32941ea5f6e2d4c51b3919e
Instruction ID: 7bb564037bb43404c1ae1388bfcd3bcc76b082b9d7e72f9c15e6bf7f30f5a691
Opcode Fuzzy Hash: 448f1b3d937953d274e284ad6e457e2ba05f70b3b32941ea5f6e2d4c51b3919e
Instruction Fuzzy Hash: B5523A31A1F7D99FEB66DB6888655A87FE0EF56304B0A01FFD089CB1E3D9146906C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B961269 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776181309.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59dc2308249fee55e89f166bd8b8c2542f2000263718182c6db050450b43f78
Instruction ID: 2d59845c850719893b766d325f23562afa437a526e4dceb76c99b8c7722c8888
Opcode Fuzzy Hash: c59dc2308249fee55e89f166bd8b8c2542f2000263718182c6db050450b43f78
Instruction Fuzzy Hash: CF612A3061EADD8FDB5ADB6488755A87BF1EF56304B0A01EBC08AC71E7DA18A906C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B96026B Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776181309.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b9cfebf928dfd3632ba2f52c928f27d287e088ae6f841b4d8d96acab5cb4c
Instruction ID: 1110a394510d7119ce19632ef2103d4fff1183c6e88e559940fca020f6640155
Opcode Fuzzy Hash: fb3b9cfebf928dfd3632ba2f52c928f27d287e088ae6f841b4d8d96acab5cb4c
Instruction Fuzzy Hash: 5051383191EA4ECFDB66DB58C8E1AE877E0FF65304F1506B9D04DCB09ACA35A946C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9613B0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776181309.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f197512fae35459aa86279bc7dc27b77b2ef77cc50f103a2a3dbddeb6093171f
Instruction ID: 9a701eb7cb3b1c9869cb50d23ed577a2bfa084c82e9ef748ec84f4741c531dd2
Opcode Fuzzy Hash: f197512fae35459aa86279bc7dc27b77b2ef77cc50f103a2a3dbddeb6093171f
Instruction Fuzzy Hash: CA21033561990D8FDF68DF18C8A54B977E1FFA8308B16066AD00BC71A9DE35B941C780

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B88AF5D Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2775008525.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208b392ca9ba8ecd8637820162e3904e862e9dc31922c8edf2bc4cbac6dd45a2
Instruction ID: c1ab88710d5f2a24d7e5b4d62a8f51744c23510438bc416104ad3086d0f65ab2
Opcode Fuzzy Hash: 208b392ca9ba8ecd8637820162e3904e862e9dc31922c8edf2bc4cbac6dd45a2
Instruction Fuzzy Hash: 5891B72164FBCA0FD7278B7488615A07FA0EF5721071A42FBC4E5CB4F3D929A94AC751

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 7520, Parent PID: 7412COMMON

Executed Functions

Function 01662648 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525e3f63a09ee3bbac525d6b26f9eddffbc4bbf0705705312dda64a7bf19e721
Instruction ID: 45adb6bd19e220e8cb4ab0a31e90da0db9e1954b35f2e51732701f70b135ebef
Opcode Fuzzy Hash: 525e3f63a09ee3bbac525d6b26f9eddffbc4bbf0705705312dda64a7bf19e721
Instruction Fuzzy Hash: E2F082356083965FC302577C9C10A2A3FBBEBCB65470941EAD449C7392CDA96C1693E3

Uniqueness

Uniqueness Score: -1.00%

Function 016607DD Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd65d3d856eaf08c4108e0c72125bc4dce96254002e25f8a3d9a6192539639d3
Instruction ID: b56c61efd6b7b65ca557fd715758211b0bde91c408cdd327be297f9bc26669e5
Opcode Fuzzy Hash: dd65d3d856eaf08c4108e0c72125bc4dce96254002e25f8a3d9a6192539639d3
Instruction Fuzzy Hash: 843191616193958FCB02DB388C143AD3F6AEB86210F2605BDD181DB2B7C7189D05C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 01661648 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8d9313c9c4b5dbb252bd1deb249e96302462fe60578f8564c284c64da71b18
Instruction ID: 31498fd47a6f787f40f9edf1b66a41ef43b8781b8f24834137ee3c80ab21097b
Opcode Fuzzy Hash: cd8d9313c9c4b5dbb252bd1deb249e96302462fe60578f8564c284c64da71b18
Instruction Fuzzy Hash: AB416D34A002058FDB15DF78D9846ADBFF6BF89300F188169D41AAB355DB35ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01661658 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca20f2aae67108737250970a80bf198437660b53dab0df02a7dcc71b75018cf
Instruction ID: ef03d02e5d2b7634840557afebb18a3b90b6872af96a2eba815983f3da78580a
Opcode Fuzzy Hash: 5ca20f2aae67108737250970a80bf198437660b53dab0df02a7dcc71b75018cf
Instruction Fuzzy Hash: 9D417E34B002098FCB14EB78D584AAEBBF6FF89310F148169D41AAB355DB75EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016609DC Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89451ba19795ba1b0b59078736e8ed07f7cc76b9e129c9e173a2b683be037daf
Instruction ID: ad4dbda78d048bbde0ea5edab46f3c8759cdb586df66771d4adeaac6433e9bcc
Opcode Fuzzy Hash: 89451ba19795ba1b0b59078736e8ed07f7cc76b9e129c9e173a2b683be037daf
Instruction Fuzzy Hash: 6831F674B44216CFDB16EB648C5473E369BAB94254F14067CE5029B3AACF288D0287D5

Uniqueness

Uniqueness Score: -1.00%

Function 01662518 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedb41b1df61399da0d35d0bbd0ac5ad28db09103eec1d85fad6fa36e453f379
Instruction ID: cc3e6d016d14b7459c6d9e1a4d04bbc4017d1cdbb730cbe7318b7e2803fb7e69
Opcode Fuzzy Hash: dedb41b1df61399da0d35d0bbd0ac5ad28db09103eec1d85fad6fa36e453f379
Instruction Fuzzy Hash: 833139316087505FC3268B3DDC20862BFF9EF8B72070541AEE44AC73A2DA64AC02C792

Uniqueness

Uniqueness Score: -1.00%

Function 01660808 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb40ee915300c57bbeafd9b864bd25e68a5daa5f59ed23d853de23ad12db1f9a
Instruction ID: d475acc4731e54f1478a88c4078b6b253d71f949b34979440734df7ab9d57f24
Opcode Fuzzy Hash: bb40ee915300c57bbeafd9b864bd25e68a5daa5f59ed23d853de23ad12db1f9a
Instruction Fuzzy Hash: 9321F9206052549FDB05EB38CC646AD3FBAAB86304F16017DE041EB3A6CA289D05C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 016608DD Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf429cc9a358ed8d58f4520443cff5f3d4b6391498fa85cd518aa48d26c31f77
Instruction ID: 602f92a266478cc9bcf2e72548ed68e53b8303bc902b657209dea2fb4d553379
Opcode Fuzzy Hash: cf429cc9a358ed8d58f4520443cff5f3d4b6391498fa85cd518aa48d26c31f77
Instruction Fuzzy Hash: 1E214D30B50116CBDB19EB69C854B3E36ABBB84745F11457CE106AB3A4CF789D028BD6

Uniqueness

Uniqueness Score: -1.00%

Function 016608E6 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f295e97c6e27e188f4ce6502b1c14f304222ef17533cc0a3ffd3690eb4d1ff
Instruction ID: b83062276f0fff89c8f7dc7782ecd1eba8b73d7ad3b7b7686cf5c7377415ab61
Opcode Fuzzy Hash: f7f295e97c6e27e188f4ce6502b1c14f304222ef17533cc0a3ffd3690eb4d1ff
Instruction Fuzzy Hash: 4B115E30B50115CBDB19EB79C854A3E36A7AB94745F11457CE102AB3A4CF689D028BD6

Uniqueness

Uniqueness Score: -1.00%

Function 016608F9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e8c49559e0c0b0224a404dc45282e11eff06a498ea160a4ccba7df2f16ff45
Instruction ID: 593087fc436fea1ead7ad35c00b6f3b929df85377166f107a86d2743ae8ed8e0
Opcode Fuzzy Hash: 90e8c49559e0c0b0224a404dc45282e11eff06a498ea160a4ccba7df2f16ff45
Instruction Fuzzy Hash: 6F118130B50115CBCB15EB798854A3E26A7ABD4704F11457CE102EB3A4CF789D028BD6

Uniqueness

Uniqueness Score: -1.00%

Function 01661C90 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92045fff4ea01d8865916b6f0ff297315975dba4002b7584db1d9874ac21797
Instruction ID: 34a0333bf3c4cd419ef4ba44aa7161bb23bcd1df5fb720779d988a302ad4d027
Opcode Fuzzy Hash: d92045fff4ea01d8865916b6f0ff297315975dba4002b7584db1d9874ac21797
Instruction Fuzzy Hash: D6110431704385AFC702AF3A9CA595B7BAAFFD225035441BED415CF351EE689C06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0166154B Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f052dd8c3cf8f0adf4c51450f3a39e08c724591e12a25bb9918ef612722b7ad
Instruction ID: 1765f0bbc9d707569330a18e2881dcce16f6afcf615e80e75eeebd984df3c1b9
Opcode Fuzzy Hash: 1f052dd8c3cf8f0adf4c51450f3a39e08c724591e12a25bb9918ef612722b7ad
Instruction Fuzzy Hash: D10149B2A602051B87057B6C58940BFFA8EFAD2360318493AD11BDB32CDE11DD0A47C5

Uniqueness

Uniqueness Score: -1.00%

Function 01660848 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e76973707961187dc6943e31d15e6c21a8c43c6671527aa709c4391e5546749
Instruction ID: c7e76d9562205ca55b33215fe7f046232b61cd16f5ebfa871d76a5606768f610
Opcode Fuzzy Hash: 5e76973707961187dc6943e31d15e6c21a8c43c6671527aa709c4391e5546749
Instruction Fuzzy Hash: 88015E30B10115DBDF54EB68C858BAE76A6AB89301F21053CE402AB3D5CF789C018BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01661CC0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cf3489e6d468290f3cf0d8e99a7c18e26fb1c2639b311f24af8a047ab0a5f1
Instruction ID: 7d4974388664502c95e5ccc8b4aa0ffa5406aa31af2be7fa0315efb479bb49c9
Opcode Fuzzy Hash: e9cf3489e6d468290f3cf0d8e99a7c18e26fb1c2639b311f24af8a047ab0a5f1
Instruction Fuzzy Hash: 12F0AF32B402016BD714AB3EAC9592F7A9EFBC52903404539E41ACB304EFA4DC058790

Uniqueness

Uniqueness Score: -1.00%

Function 0166257F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9d1fec0311b92a77246590533d4f64680ad273f0cbcc1796073d444f4adf5e
Instruction ID: 1b8b06f8a14f94f391c97627b33d8b22413bda9e6ecbbc8bea1e7e7429e2e888
Opcode Fuzzy Hash: 3b9d1fec0311b92a77246590533d4f64680ad273f0cbcc1796073d444f4adf5e
Instruction Fuzzy Hash: 2BF0F031B043456FD7165B78AC1096A7FFAFFCA620B0441AEE41EC3392CEAC4D169396

Uniqueness

Uniqueness Score: -1.00%

Function 01661752 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67124e07c3911c2e77cb044801abb4f4d3d6f8a514f82cf3f9108643fe0a11f3
Instruction ID: 64e53241f6bd5f2abc0de11b545e395344db83b0cd6fda64c38310d406fb4112
Opcode Fuzzy Hash: 67124e07c3911c2e77cb044801abb4f4d3d6f8a514f82cf3f9108643fe0a11f3
Instruction Fuzzy Hash: 1301DC317402018FCB11EB68E9805BDBBE3EFC8300B148429C4179B364DF7AEC468B92

Uniqueness

Uniqueness Score: -1.00%

Function 01660957 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b600bf7b4f0389d4f888984bdd4ab9d881df4e9778c12ef0401811c6d0e98ee6
Instruction ID: 3f415f05d832dca7e62dc4d35b784329c9bfd65945315a019db2f39d1f8776db
Opcode Fuzzy Hash: b600bf7b4f0389d4f888984bdd4ab9d881df4e9778c12ef0401811c6d0e98ee6
Instruction Fuzzy Hash: 7DF04F30B51115CBCF54EFA9C854B7E76AABB88704F25053DE402AB3A4CF789D028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 01661BE8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ff145b746060497bcdabced7bd6cc66cbed0745f224521aa9017db2416b7f1
Instruction ID: 14f640f2f1db774c68e9ea373004213d1e2400d3fca3f80438e19c10c43e68b7
Opcode Fuzzy Hash: 48ff145b746060497bcdabced7bd6cc66cbed0745f224521aa9017db2416b7f1
Instruction Fuzzy Hash: 48F0E9357041955FD7015B6C9C405663BAAEBCB75070941E6D409C7341CEA46C0753E3

Uniqueness

Uniqueness Score: -1.00%

Function 01661578 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601984828c27de8c66db270bfa9713e0ff5f543872ee634dd3e9027108408298
Instruction ID: bab2e85a594892c09c4a9e7a6e79c1d2f1a9afcae8e30802c4cb6f1790166e96
Opcode Fuzzy Hash: 601984828c27de8c66db270bfa9713e0ff5f543872ee634dd3e9027108408298
Instruction Fuzzy Hash: FEF0E2326006011BC306AB7DD8108BFBADABEC2254344497ED119CB764EE51EC0A87D6

Uniqueness

Uniqueness Score: -1.00%

Function 01661C40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ccdf6b7ee955d692cb2b8a11f133bce588832d8e93eb8d656f2b22abdb67
Instruction ID: 2abacad0cefc1f006365bffdf108ea51c9dfca81984dc0c82f2f6413b63326cb
Opcode Fuzzy Hash: 39f5ccdf6b7ee955d692cb2b8a11f133bce588832d8e93eb8d656f2b22abdb67
Instruction Fuzzy Hash: 7FF0923091934AEFCB41DFB8DE9589DBFF4EB16300B1440E9C404DB215EA325E059B51

Uniqueness

Uniqueness Score: -1.00%

Function 01661C50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3386624763.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198deb75d362c58b4c6fb9852fb1c7616aab18c5f667d1aaf9b27fb69e84f51b
Instruction ID: 1cefaf65bab77d5d1d61f28e5475f742a6e384934efbb949cb4058606662e994
Opcode Fuzzy Hash: 198deb75d362c58b4c6fb9852fb1c7616aab18c5f667d1aaf9b27fb69e84f51b
Instruction Fuzzy Hash: 89D01770A00109EF8B40DFA8EA8199EBBB9EB44300B1045A9D808D3200EA326E049B80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: JPl4ZLOvy3fY5RSXGk5s9Gl5.exePID: 7912, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	2.8%
Signature Coverage:	12.3%
Total number of Nodes:	1012
Total number of Limit Nodes:	14

Executed Functions

Function 00424A0E Relevance: 55.5, APIs: 2, Strings: 29, Instructions: 1273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00426235: __EH_prolog.LIBCMT ref: 0042623A

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0043AEF4), ref: 00424AD5

Part of subcall function 00425E92: __EH_prolog.LIBCMT ref: 00425E97
Part of subcall function 00425E92: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00425F79

GetTempPathA.KERNEL32(00000104,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 00425A16

Strings

P, xrefs: 00425D69
/syncUpd.exe, xrefs: 00425607, 00425689, 004256E3
six, xrefs: 00424C4A, 00424C60, 00424DAD
185.172.128.59, xrefs: 0042554C, 004255E6, 004256DA
three, xrefs: 00424B7E, 00424BAC, 00424D98
P, xrefs: 004256EB
seven, xrefs: 00424C7E, 00424CAC, 00424DB4
two, xrefs: 00424B4A, 00424B60, 00424D91
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 00424DE0, 00424F76, 00424F8D
SOFTWARE\BroomCleaner, xrefs: 00425119, 0042520D
185.172.128.228, xrefs: 004252D0, 00425376, 004254F5
P, xrefs: 004259C6
nine, xrefs: 00424D16, 00424D38, 00424DC2
P, xrefs: 004250D3
P, xrefs: 00425505
/ping.php?substr=%s, xrefs: 00425397, 0042546D, 00425485
Installed, xrefs: 00425227, 00425285
serversystemNCQ_x64.exe, xrefs: 00425A25, 00425B30
185.172.128.90, xrefs: 00424FDB, 00425075, 004250C3
sub=([\w-]{1,255}), xrefs: 00424AA2
ten, xrefs: 00424D56, 00424D6C, 00424DC9
185.172.128.228, xrefs: 00425BA6, 00425C4C, 00425D58
/BroomSetup.exe, xrefs: 00425C6D, 00425D13, 00425D61
five, xrefs: 00424C0A, 00424C2C, 00424DA6
note.padd.cn.com, xrefs: 00425768, 00425820, 004259B5
four, xrefs: 00424BCA, 00424BEC, 00424D9F
one, xrefs: 00424B14, 00424B2A, 00424D8E
eight, xrefs: 00424CCA, 00424CF8, 00424DBB
/1/serversystemNCQ_x64.exe, xrefs: 0042583A, 00425964, 004259BE

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamePathTempstd::ios_base::_
String ID: /1/serversystemNCQ_x64.exe$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$eight$five$four$nine$note.padd.cn.com$one$serversystemNCQ_x64.exe$seven$six$sub=([\w-]{1,255})$ten$three$two
API String ID: 929474060-2157447433
Opcode ID: 17bf2574a8bbe870a88041cf645c46bd632d7aae589e26ee0f3dcd36f1da404d
Instruction ID: 6b72c2e5a1472f1d435c072ec535a3c6db0bd386d75e29162859cb6ea77325b9
Opcode Fuzzy Hash: 17bf2574a8bbe870a88041cf645c46bd632d7aae589e26ee0f3dcd36f1da404d
Instruction Fuzzy Hash: 65A2341058A2E19AC712FB75581758A3FE51B6230EF54787FE5D12F2A3C96C821C839F

Uniqueness

Uniqueness Score: -1.00%

Function 004263E5 Relevance: 50.1, APIs: 16, Strings: 12, Instructions: 1148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004263EA
WSAStartup.WS2_32(00000202,?), ref: 00427076
socket.WS2_32(00000002,00000001,00000006), ref: 0042708C
WSACleanup.WS2_32 ref: 004270A6
gethostbyname.WS2_32(00000000), ref: 004270BA
htons.WS2_32(?), ref: 004270EC
connect.WS2_32(00000000,?,00000010), ref: 004270FD
send.WS2_32(00000000,00000000,00000000,00000000), ref: 00427120
send.WS2_32(00000000,00000000,?,00000000), ref: 0042713C
recv.WS2_32(00000000,00000000,00000001,00000000), ref: 0042717C
recv.WS2_32(?,00000000,00000001,00000000), ref: 004272FA
recv.WS2_32(?,?,00000000,00000000), ref: 00427399
recv.WS2_32(?,0000000A,00000002,00000000), ref: 004273C0
recv.WS2_32(00000000,?,?,00000000), ref: 00427421
WSACleanup.WS2_32 ref: 0042745F
closesocket.WS2_32(?), ref: 00427466

Strings

HTTP/1.1, xrefs: 004267D7, 00426835, 0042684C
Transfer-Encoding, xrefs: 00426584, 00426642, 00427260
(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36, xrefs: 00426C8E, 00426F14, 00426F2B
HTTP/1.1 200 OK, xrefs: 00426406, 004264B3, 004271C4
chunked, xrefs: 00426660, 004266A6, 00427271
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 , xrefs: 00426997, 00426C65, 00426C7C
User-Agent: , xrefs: 004268EC, 0042696E, 00426985
GET , xrefs: 0042676E, 00426790, 004267AA
Content-Length, xrefs: 004264CC, 00426566, 00427224
185.172.128.90, xrefs: 004263F6
POST , xrefs: 00426720, 0042674E, 004267B2
Host: , xrefs: 0042686B, 004268A5, 004268BC

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: recv$Cleanupsend$H_prologStartupclosesocketconnectgethostbynamehtonssocket
String ID: HTTP/1.1$(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36$185.172.128.90$Content-Length$GET $HTTP/1.1 200 OK$Host: $Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 $POST $Transfer-Encoding$User-Agent: $chunked
API String ID: 791229064-1222584043
Opcode ID: 18be0af429a46002ce92d847665834a75d1367100ef1fb5941ab536c06ff8f93
Instruction ID: c02e3a93c91f732d40d098133b2ecf2832f7337e1a98b712c75d7e50267902da
Opcode Fuzzy Hash: 18be0af429a46002ce92d847665834a75d1367100ef1fb5941ab536c06ff8f93
Instruction Fuzzy Hash: F492965094A2A19ACB02FFB5685659E3FF4592130D714647FE5D06F3A3CA2C821C87AF

Uniqueness

Uniqueness Score: -1.00%

Function 004139E7 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002,00000000,?,00412B6B,00000003), ref: 00413A08
TerminateProcess.KERNEL32(00000000,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002,00000000,?,00412B6B,00000003), ref: 00413A0F
ExitProcess.KERNEL32 ref: 00413A21

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 894b5bdb18b640f385292c5622eb6f2d8d3b57cbb89090b821d2e36a11f43174
Instruction ID: bfadc2acc187f9cfd988f020b0af5571caefb971efb7e130f1d0998baf6699a9
Opcode Fuzzy Hash: 894b5bdb18b640f385292c5622eb6f2d8d3b57cbb89090b821d2e36a11f43174
Instruction Fuzzy Hash: 53E04F31101504ABCF116F14DD0898A3B29EF00786F418029F94596132DF39DE86CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02F1F78E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02F1F7B6
Module32First.KERNEL32(00000000,00000224), ref: 02F1F7D6

Memory Dump Source

Source File: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2f1e000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fa3fbd898c1a5e69885896c9ffa14e53562e335812cfaf8f1a17ee81a9ab4d42
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 45F09636600715ABD7203BF5AC8DB6E76E8AF49664F900629F743918C0DB70E8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 0041A242 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419F10: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00419F2D

GetLastError.KERNEL32 ref: 0041A356
__dosmaperr.LIBCMT ref: 0041A35D
GetFileType.KERNEL32(00000000), ref: 0041A369
GetLastError.KERNEL32 ref: 0041A373
__dosmaperr.LIBCMT ref: 0041A37C
CloseHandle.KERNEL32(00000000), ref: 0041A39C
CloseHandle.KERNEL32(?), ref: 0041A4E6
GetLastError.KERNEL32 ref: 0041A518
__dosmaperr.LIBCMT ref: 0041A51F

Strings

H, xrefs: 0041A4A4

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d610beb6fdae7f59e9ad9f33e2ca6ec6ebc0d6293e5c15d19bd92f4cf96793f
Instruction ID: 5ed0b96f73270941775a85281cb99d597b6a4d56659bde6f01148d564b9c2f2b
Opcode Fuzzy Hash: 3d610beb6fdae7f59e9ad9f33e2ca6ec6ebc0d6293e5c15d19bd92f4cf96793f
Instruction Fuzzy Hash: DDA15732A041089FDF189F78D8517EE3BA1AF06324F18015EEC51EB391D7398D66C75A

Uniqueness

Uniqueness Score: -1.00%

Function 004192AD Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9117c4caaae958124344d97274fd67e90a93c7c171772c9c3d1069b47ac8b3f
Instruction ID: ad7a334a3c542fe0f14731be173b353b81adde24e2ae5a0363ed5934dc533936
Opcode Fuzzy Hash: a9117c4caaae958124344d97274fd67e90a93c7c171772c9c3d1069b47ac8b3f
Instruction Fuzzy Hash: 72C11A71D04249AFDB11CFA9C850BEE7BB1BF09314F08419AE854B7392C7789D81CB69

Uniqueness

Uniqueness Score: -1.00%

Function 049A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 049A024D

Strings

cess, xrefs: 049A018D
kernel32.dll, xrefs: 049A008F, 049A0095

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9674df457cb51def17ee2d820b8954ee18748b3b4b03a36218e785dfbf588e5c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A7527974A01229DFDB64CF58C984BACBBB1BF09304F1480E9E94DAB351DB30AA94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00425FFF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00426004
RegCreateKeyExA.KERNEL32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,0043AE60,SOFTWARE\BroomCleaner), ref: 0042602C
RegSetValueExA.KERNEL32(?,?,00000000,00000001,?,?,0043AE60,0043AE61,Installed,Installed), ref: 004260AF
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 004260D0

Strings

SOFTWARE\BroomCleaner, xrefs: 0042600C, 0042601F
Installed, xrefs: 0042600E, 0042603C, 0042605B, 0042605C

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction ID: 88d0ffafad339e53c26632b4546833d70425ff8bf3c95ccbaa1921ace6490f97
Opcode Fuzzy Hash: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction Fuzzy Hash: E431A771A00228AFDB148FA8DC94AFEBB78FB08358F44012EE802B3281C7B51D05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004260E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 00426131
WriteFile.KERNEL32(00000000,?,00000400,AWB,00000000), ref: 00426149
CloseHandle.KERNEL32(00000000), ref: 00426152

Strings

AWB, xrefs: 0042613E, 00426141
/syncUpd.exe, xrefs: 004260EC

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: /syncUpd.exe$AWB
API String ID: 1065093856-3279009668
Opcode ID: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction ID: ea454d58db3f570a703faf9f62bcad87da157c20184f63e0e300e902c8c0e078
Opcode Fuzzy Hash: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction Fuzzy Hash: D5F0F9B2301631BBD72416A6AC49E6BBB5DEF447A4F41003AF705D3292DA75FC1582AC

Uniqueness

Uniqueness Score: -1.00%

Function 004261D1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,serversystemNCQ_x64.exe), ref: 00426207
WriteFile.KERNEL32(00000000,?,00000400,00425B7F,00000000), ref: 0042621F
CloseHandle.KERNEL32(00000000), ref: 00426228

Strings

serversystemNCQ_x64.exe, xrefs: 004261D5, 004261F6

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: serversystemNCQ_x64.exe
API String ID: 1065093856-4105491473
Opcode ID: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction ID: e17ace126460657e3681985d0a65b8929ef4349a74fc66e1559dc9d9555c5b24
Opcode Fuzzy Hash: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction Fuzzy Hash: A7F0F6B2701231BBD3305AA6AC48E6BBA5DFF44664F41003ABB01D3150CBB5EC11D2F8

Uniqueness

Uniqueness Score: -1.00%

Function 0042615F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?,/BroomSetup.exe), ref: 004261A1
WaitForSingleObject.KERNEL32(?,00008000), ref: 004261B5
CloseHandle.KERNEL32(?), ref: 004261BE

Strings

/BroomSetup.exe, xrefs: 0042616A

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: /BroomSetup.exe
API String ID: 3837156514-1897133622
Opcode ID: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction ID: 1e311514b9377177f2af020c61367fd92aa00ac37d84a7ed16a1071a1e85f590
Opcode Fuzzy Hash: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction Fuzzy Hash: F9018F71E00218EBDF15DF69EC455DDBBB8FF08310F41812AF801A6260EB709A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00419767 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000002,?,00000000,?,?,?,?,?,00419816,?,?,00000002,00000000), ref: 004197A0
GetLastError.KERNEL32(?,00419816,?,?,00000002,00000000,?,00416146,?,00000000,00000000,00000002,?,?,?,?), ref: 004197AA
__dosmaperr.LIBCMT ref: 004197B1

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: df2fb0bbc630fe00730a1d3e395213de1702832fc36ed6d5d61208973ec6bf62
Instruction ID: 474d12f0d1f251b5c01d6f3fc33b49c877c5e51dc48bc47fa5668562e13d0985
Opcode Fuzzy Hash: df2fb0bbc630fe00730a1d3e395213de1702832fc36ed6d5d61208973ec6bf62
Instruction Fuzzy Hash: 1E012D36620515ABCB159FA9DC058EE7B19DF85330B28024EFC619B2D0EA749C918798

Uniqueness

Uniqueness Score: -1.00%

Function 00419CC3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 227
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00419F2D

Strings

@, xrefs: 00419D84

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CreateFile
String ID: @
API String ID: 823142352-2766056989
Opcode ID: 5f6990ddce253bec854566fd7a1e26849d5a3d230f9db06db37147ff82feb7e3
Instruction ID: 1485254fa7f833b9d87c21434d611f3dfdfd80a983df9394cee0aa11d74a67a7
Opcode Fuzzy Hash: 5f6990ddce253bec854566fd7a1e26849d5a3d230f9db06db37147ff82feb7e3
Instruction Fuzzy Hash: 6C61F671900209AAEF249E28ECA1BFF3659DB01324F28066BF914D63E1D37DCDD1C299

Uniqueness

Uniqueness Score: -1.00%

Function 00401BB2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 0040307C: __EH_prolog.LIBCMT ref: 00403081

Part of subcall function 00402FE5: __EH_prolog.LIBCMT ref: 00402FEA
Part of subcall function 00402FE5: std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00402F6B: __EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

v*@, xrefs: 00401BD0

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog$Exception@8InitThrowstd::locale::_std::system_error::system_error
String ID: v*@
API String ID: 3966877926-3062513736
Opcode ID: 240a4362d17f14c59b940fe530da69547b533384544aaaadc70cf94112413839
Instruction ID: 2906f591fdcd98215504c4db900cd9c5f4984944fab9ade983be526ff471b933
Opcode Fuzzy Hash: 240a4362d17f14c59b940fe530da69547b533384544aaaadc70cf94112413839
Instruction Fuzzy Hash: B6215EB1611206AFD708DF59C88AA6AF7F9FF48348F14826EE115A7341D7B8DD048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00425E92 Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00425E97

Part of subcall function 00401BB2: __EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 00402403: __EH_prolog.LIBCMT ref: 00402408

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00425F79

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 420165198-0
Opcode ID: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction ID: 2556a8629159148f8f48e0708bdd224720a40a44b3f3f3bd97029f0642dfd191
Opcode Fuzzy Hash: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction Fuzzy Hash: 3731F570D01119EBDB14EF95E985AEDFBB4BF48304F5081AEE405B3681EB786A04CF64

Uniqueness

Uniqueness Score: -1.00%

Function 049A0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,049A0223,?,?), ref: 049A0E19
SetErrorMode.KERNEL32(00000000,?,?,049A0223,?,?), ref: 049A0E1E

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8cc1a420990746618cf72a370a5af9752219a4a2f98d9fd987ef948e3681c966
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C1D0123114512877DB402E94DC0DBCD7B1CDF09B62F108021FB0DD9080C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041878B Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ad06baf811014e6e5f204b8b24a1eec4f86eb4dd968a0a20361761455e3fdc
Instruction ID: fd9d528a0c7afc623981433e04a224839326e77561e427239af827bb4a6996c4
Opcode Fuzzy Hash: 52ad06baf811014e6e5f204b8b24a1eec4f86eb4dd968a0a20361761455e3fdc
Instruction Fuzzy Hash: 8E51F771A00108AFDB10DF69C840BFA7BA5EF85364F59815EE8489B392CB39DD82C755

Uniqueness

Uniqueness Score: -1.00%

Function 00401F2B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00402008

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 25aeabf7499e8ad583be7248ba51f421055d1c52451b24307ef19921f3e1bf67
Instruction ID: 0bde1253143090ae73d8540e9fd285f072e0ff93183f3a7406587cf81db67a05
Opcode Fuzzy Hash: 25aeabf7499e8ad583be7248ba51f421055d1c52451b24307ef19921f3e1bf67
Instruction Fuzzy Hash: CF316B31604706AFC710DE29C884A5ABBA0BF88354F04863EF954A73A1D779D854CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004024A1 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004024A6

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Exception@8H_prologThrowstd::system_error::system_error
String ID:
API String ID: 938716162-0
Opcode ID: 3289019c20cb4556ee6c38f5e2da7034edf6970fc1a8ccc22b3f8cd15b199a8e
Instruction ID: f9688b0c90679192299e0bb7a3439a4399c8f0768580163213d8cecdb75eb4b1
Opcode Fuzzy Hash: 3289019c20cb4556ee6c38f5e2da7034edf6970fc1a8ccc22b3f8cd15b199a8e
Instruction Fuzzy Hash: AE318B71A00515AFCB18DF29C9D5E6AB7F5FF84318718C16EE416AB791C634EC40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040257C Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402581

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 291e7d1b3f6cf1fc2dccdca70f715a4ec6857470b8c4d5c93d697d15b5cdd404
Instruction ID: 579ab2d92f659928d645a67e5e22432caab009e00a2c317709415ae2193797db
Opcode Fuzzy Hash: 291e7d1b3f6cf1fc2dccdca70f715a4ec6857470b8c4d5c93d697d15b5cdd404
Instruction Fuzzy Hash: 55318570A00619AFCB15DF09CA84A9ABBB5FF48308F14856EE405AB791C7B9ED40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402403 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402408

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d2d9b6b43cfdf996835e501fea2ee693a7f56e5686c885c3d9c862d0dd8198d7
Instruction ID: dba47e39e8d0c89352df1fbf4b30e2bb14e57b784247d2a0b0b3577a8c407922
Opcode Fuzzy Hash: d2d9b6b43cfdf996835e501fea2ee693a7f56e5686c885c3d9c862d0dd8198d7
Instruction Fuzzy Hash: 07218E70601611DFC728DF19C54896ABBF5FF88314B20C26EE85AAB7A1C374EE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0041AED0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0041AF0E

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 3d975e7e6cbb78488cc061dbf685c7f7941f423534bf463c83edbdca8607934f
Instruction ID: e517ab393e7309e987bd06d7ace07ed33cf8ef7f106266aa14b3143d95857183
Opcode Fuzzy Hash: 3d975e7e6cbb78488cc061dbf685c7f7941f423534bf463c83edbdca8607934f
Instruction Fuzzy Hash: 54114C71904209AFCF05DF58E9419DB7BF4EF48314F10409AF808AB311D635D9618B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00402F6B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 004035F5: __EH_prolog.LIBCMT ref: 004035FA
Part of subcall function 004035F5: std::_Lockit::_Lockit.LIBCPMT ref: 00403609
Part of subcall function 004035F5: int.LIBCPMT ref: 00403620
Part of subcall function 004035F5: std::locale::_Getfacet.LIBCPMT ref: 00403629
Part of subcall function 004035F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00403670

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prologLockitstd::_$GetfacetLockit::_Lockit::~_std::locale::_
String ID:
API String ID: 3585332825-0
Opcode ID: a6ab362fac026c4336eb4d324ac0ee64ede451761661cacb1181b9d48738e12c
Instruction ID: 9ea047f1679d3f1c5945bcfcf49701419db79aaecc95a1d6f6b9c9ff7255fd05
Opcode Fuzzy Hash: a6ab362fac026c4336eb4d324ac0ee64ede451761661cacb1181b9d48738e12c
Instruction Fuzzy Hash: 6E018F70610114AFDB14EB25CA0ABAEB7F9AF04708F00402EF405B76D1DBF8AE408B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D1 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041A212

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68fd172b046a401a07b87b6cc8e6e0eb4e84c281b2bbab5ff70b0aff8b290acd
Instruction ID: 12cd10f48dc7b96564373969defca7bad1702ec24c59837b56aad39c86ff4cfc
Opcode Fuzzy Hash: 68fd172b046a401a07b87b6cc8e6e0eb4e84c281b2bbab5ff70b0aff8b290acd
Instruction Fuzzy Hash: AFF09A32511119BBCF005E96DC02CDA3B6EEF89334F100156F91492150DA3ADD60A7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00417A45 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5597b3fef2049d4b94b9b28840fe08f3b449df791141d5097313f0f524cf2598
Instruction ID: b5ba98d12a3d3f69e8fd305ea92f8e9f348d5f1b31b2d1e3b8fe5de402ef0145
Opcode Fuzzy Hash: 5597b3fef2049d4b94b9b28840fe08f3b449df791141d5097313f0f524cf2598
Instruction Fuzzy Hash: 12E0A03128821557973026729C017DF66699F417E1B190123AC04962A0CA5C8BD181AD

Uniqueness

Uniqueness Score: -1.00%

Function 00409256 Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00409967

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 3493f753b1486d58973e154b97d64109dfccfe3e8fab1b3c27d4c8eca396d5cc
Instruction ID: b1d4d2c8bd5c33842f46a32f8b4bbf06a66db444bdcfb0a1f556bd7da6e477e1
Opcode Fuzzy Hash: 3493f753b1486d58973e154b97d64109dfccfe3e8fab1b3c27d4c8eca396d5cc
Instruction Fuzzy Hash: D4E0927440430DB6CB007A66EC169AE375C1E00324B208A7FB918B55E2EB78DDAAC59E

Uniqueness

Uniqueness Score: -1.00%

Function 00419F10 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00419F2D

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 938609861a59e87d92f3a0c73e0613ce9160f7b54543d4443c23c2832b1bfae6
Instruction ID: 5eb29461e2ddc9ae740c772c154a31e7a3cc6174a3f1b9e62ad8f29cf5827f76
Opcode Fuzzy Hash: 938609861a59e87d92f3a0c73e0613ce9160f7b54543d4443c23c2832b1bfae6
Instruction Fuzzy Hash: E4D06C3210010DBBDF129F84DD06EDA3BAAFB48754F018010BA5856060C732E832AB94

Uniqueness

Uniqueness Score: -1.00%

Function 02F1F44D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 02F1F49E

Memory Dump Source

Source File: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2f1e000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fabd4502ace6011447e82e50fd01a515dc95ebd793c54d9f83b920f6c7b22d34
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6A113C79A00208EFDB01DF98CA85E98BBF5AF08351F058094FA489B362D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 049C4C75 Relevance: 55.5, APIs: 2, Strings: 29, Instructions: 1252COMMON

Download Yara Rule

APIs

Part of subcall function 049C649C: __EH_prolog.LIBCMT ref: 049C64A1

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0043AEF4), ref: 049C4D3C

Part of subcall function 049C60F9: __EH_prolog.LIBCMT ref: 049C60FE
Part of subcall function 049C60F9: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 049C61E0

Strings

/syncUpd.exe, xrefs: 049C586E, 049C58F0, 049C594A
185.172.128.228, xrefs: 049C5537, 049C55DD, 049C575C
185.172.128.228, xrefs: 049C5E0D, 049C5EB3, 049C5FBF
/ping.php?substr=%s, xrefs: 049C55FE, 049C56D4, 049C56EC
P, xrefs: 049C5C2D
P, xrefs: 049C5952
serversystemNCQ_x64.exe, xrefs: 049C5C8C, 049C5D97
five, xrefs: 049C4E71, 049C4E93
nine, xrefs: 049C4F7D, 049C4F9F
P, xrefs: 049C576C
Installed, xrefs: 049C548E, 049C54EC
185.172.128.59, xrefs: 049C57B3, 049C584D, 049C5941
/1/serversystemNCQ_x64.exe, xrefs: 049C5AA1, 049C5BCB, 049C5C25
three, xrefs: 049C4DE5, 049C4E13
P, xrefs: 049C533A
@, xrefs: 049C4CE3
/BroomSetup.exe, xrefs: 049C5ED4, 049C5F7A, 049C5FC8
eight, xrefs: 049C4F31, 049C4F5F
six, xrefs: 049C4EB1, 049C4EC7
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 049C5047, 049C51DD, 049C51F4
SOFTWARE\BroomCleaner, xrefs: 049C5380, 049C5474
note.padd.cn.com, xrefs: 049C59CF, 049C5A87, 049C5C1C
P, xrefs: 049C5FD0
one, xrefs: 049C4D7B, 049C4D91
four, xrefs: 049C4E31, 049C4E53
seven, xrefs: 049C4EE5, 049C4F13
two, xrefs: 049C4DB1, 049C4DC7
ten, xrefs: 049C4FBD, 049C4FD3
185.172.128.90, xrefs: 049C5242, 049C52DC, 049C532A

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamestd::ios_base::_
String ID: @$/1/serversystemNCQ_x64.exe$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$eight$five$four$nine$note.padd.cn.com$one$serversystemNCQ_x64.exe$seven$six$ten$three$two
API String ID: 2531350358-943425476
Opcode ID: 6de0276b107486a6e474e1e0084ba7586d55d8bfa3271348581a8865d76d9fa7
Instruction ID: e53ff5ad9bab66fe8bc470adc475e8e5b6d960d775578a637dede944222314f8
Opcode Fuzzy Hash: 6de0276b107486a6e474e1e0084ba7586d55d8bfa3271348581a8865d76d9fa7
Instruction Fuzzy Hash: 04A2EE1048B2D0AEE721F778585758E3BE11AA3349F9CA4B9C4E11B363D954A53C83EF

Uniqueness

Uniqueness Score: -1.00%

Function 0042086B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetUserDefaultLCID.KERNEL32 ref: 00420977
IsValidCodePage.KERNEL32(00000000), ref: 004209D2
IsValidLocale.KERNEL32(?,00000001), ref: 004209E1
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00420A29
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00420A48

Strings

0B, xrefs: 00420924

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: 0B
API String ID: 745075371-4003747729
Opcode ID: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction ID: 650ebaacf82e858368a26b85c64588bb52e0d85139106dd20bcc8c2b817cb8b1
Opcode Fuzzy Hash: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction Fuzzy Hash: 475184B1B002259AEB20DFA5EC45BBF77F8AF04700F94046BE905E7253D7789984CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FF33 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

IsValidCodePage.KERNEL32(00000000), ref: 00420015
_wcschr.LIBVCRUNTIME ref: 004200A5
_wcschr.LIBVCRUNTIME ref: 004200B3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00420156

Strings

0B, xrefs: 0041FFA6

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: 0B
API String ID: 4212172061-4003747729
Opcode ID: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction ID: 96eb391d46ce5fb78e8006d1997cb9303ceaefbbeb856b82c66811b22ec73256
Opcode Fuzzy Hash: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction Fuzzy Hash: CD61F971700216AAE724AB35EC42BEB77E8EF04314F54403FF505D7282EA79E986C768

Uniqueness

Uniqueness Score: -1.00%

Function 00420697 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00420730
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00420759
GetACP.KERNEL32 ref: 0042076E

Strings

OCP, xrefs: 004206EB
ACP, xrefs: 004206B5

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction ID: f807061c0cfb0377689ec6e1dc83ff6a27fcbbb4928d2f32a34ff3ed1f12855e
Opcode Fuzzy Hash: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction Fuzzy Hash: D021D822B00125A7D7308F54E900A9BB3E6AFD0F50BD68076E90AD7312E736ED41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 049C08FE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 049C0997
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 049C09C0
GetACP.KERNEL32 ref: 049C09D5

Strings

OCP, xrefs: 049C0952
ACP, xrefs: 049C091C

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction ID: 01a4bd18ad82221c578389e0dd756435de8e750dc97e58de86d7996ef1fe90f5
Opcode Fuzzy Hash: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction Fuzzy Hash: 5421A122B01104EAF7348FD5C801BA7B3AAAB40B60F46847CEA4AD7101E732EA40C796

Uniqueness

Uniqueness Score: -1.00%

Function 049C0AD2 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FDF
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FEC

GetUserDefaultLCID.KERNEL32 ref: 049C0BDE
IsValidCodePage.KERNEL32(00000000), ref: 049C0C39
IsValidLocale.KERNEL32(?,00000001), ref: 049C0C48
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 049C0C90
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 049C0CAF

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction ID: ff054e7d2a61a8f72c602d19dc1edf8a141a782a69ba7939dd704ebb5cc12473
Opcode Fuzzy Hash: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction Fuzzy Hash: 7A515B71A00219EFEF20DFE5DC44ABAB7BCAF44704F44447DE914EB190EB70AA458B62

Uniqueness

Uniqueness Score: -1.00%

Function 004123A0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

y%B, xrefs: 004123BD, 00412568, 0041278C, 00412726, 004125B6, 00412544
y%B, xrefs: 00412808, 004125F2, 00412481

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID: y%B$y%B
API String ID: 0-2510245575
Opcode ID: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction ID: 7f81a5055d29d3c9b3a65b9dd9c97bea9b47a5c616e9cad61c519a63aba044dd
Opcode Fuzzy Hash: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction Fuzzy Hash: F8024C71E002199FDF14CFA9D9806EEB7F1FF88314F25826AD819E7380D774AA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 049C019A Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

IsValidCodePage.KERNEL32(00000000), ref: 049C027C
_wcschr.LIBVCRUNTIME ref: 049C030C
_wcschr.LIBVCRUNTIME ref: 049C031A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 049C03BD

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction ID: 2a9d228ebe7ab98a8dac2e5d7ada7f6f10e15389678285df9691d2fb5e997709
Opcode Fuzzy Hash: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction Fuzzy Hash: B961D971A00206EBEB24AFB4DC45FAA77ACEF44714F14447EE949DB180EA74F94487E2

Uniqueness

Uniqueness Score: -1.00%

Function 0042031E Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420372
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004203C3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420483

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 5b72115e8b3d99db5ee644b06332b43cb25b862bc34a9776d716a8c8283a0e68
Instruction ID: e49ff8fe4670d0273f63fc0405290e337e91ea8406976b64d41fdeda8fa98918
Opcode Fuzzy Hash: 5b72115e8b3d99db5ee644b06332b43cb25b862bc34a9776d716a8c8283a0e68
Instruction Fuzzy Hash: EB618571700127ABDB28DF25DC81BBA77E8EF04344F50807AE905C6642E77CE995CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041073B Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00410833
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041083D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041084A

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2e0c4ce7fc6f97195f0dd2060de5b9be5f08cd0aee2531fe00585e805eb4148f
Instruction ID: 83fb90e8a7c5f9d9a6e74ed2432930f3ebad2766a255ac5393aec732c1f36b41
Opcode Fuzzy Hash: 2e0c4ce7fc6f97195f0dd2060de5b9be5f08cd0aee2531fe00585e805eb4148f
Instruction Fuzzy Hash: 9231C3749012189BCB21EF25DD887DDB7B8BF08310F5041EAE41CA7291EB749F858F88

Uniqueness

Uniqueness Score: -1.00%

Function 049B09A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 049B0A9A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 049B0AA4
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 049B0AB1

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2e0c4ce7fc6f97195f0dd2060de5b9be5f08cd0aee2531fe00585e805eb4148f
Instruction ID: 7c53f5fe544411eac89a9fee7adb3f58b3acca18af77e11bf618f5962bc09b67
Opcode Fuzzy Hash: 2e0c4ce7fc6f97195f0dd2060de5b9be5f08cd0aee2531fe00585e805eb4148f
Instruction Fuzzy Hash: CC31C97490121C9BDB21DF68DD887DDB7B8BF48310F5045EAE41CA7250E770AB958F85

Uniqueness

Uniqueness Score: -1.00%

Function 049B3C4E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,049B3C24,00000003,00437D60,0000000C,049B3D7B,00000003,00000002,00000000,?,049B2DD2,00000003), ref: 049B3C6F
TerminateProcess.KERNEL32(00000000,?,049B3C24,00000003,00437D60,0000000C,049B3D7B,00000003,00000002,00000000,?,049B2DD2,00000003), ref: 049B3C76
ExitProcess.KERNEL32 ref: 049B3C88

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 894b5bdb18b640f385292c5622eb6f2d8d3b57cbb89090b821d2e36a11f43174
Instruction ID: f600988fee3d08fda39e85a4ad32953db380c4132b097a6acd8f3f6d075ac8d0
Opcode Fuzzy Hash: 894b5bdb18b640f385292c5622eb6f2d8d3b57cbb89090b821d2e36a11f43174
Instruction Fuzzy Hash: 80E0BF31101544ABCF62AF94DF089893F69EB44645F418474FD4586132CF35E956CB84

Uniqueness

Uniqueness Score: -1.00%

Function 049A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 049A0966
., xrefs: 049A095F
GetProcAddress., xrefs: 049A09DC, 049A09DF, 049A09E4

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 5b143020be640603938b3c541d7072067eabae1db30e36e72003d24b4052acc0
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 79314AB6900609DFEB10CF99C884AAEBBF9FF48324F15405AD941A7310D771FA55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004174E4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00413D9B,?,00000004), ref: 00417537

Strings

GetLocaleInfoEx, xrefs: 004174F5, 004174FF

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 5624002d6b428694473462ba0072f2f24f44899c1fa35fdf49f16317c2614754
Instruction ID: eb066377b6a6f3e9ff085c9de847c8580b30247b499f366338aeab0e0db1c657
Opcode Fuzzy Hash: 5624002d6b428694473462ba0072f2f24f44899c1fa35fdf49f16317c2614754
Instruction Fuzzy Hash: BEF0F631740218BBDB11AF61AC01FAE3B75DF08711F90005AFC0527292CF755D509A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042056E Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004205C2

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 07176d041ccb76ae88aba79526e47c474368dd3b10318d7024768d010027b9a4
Instruction ID: 77ec679e931d5f83319bd54e9c5f414fd5e1a778dc4a26272ac96700fb2417fe
Opcode Fuzzy Hash: 07176d041ccb76ae88aba79526e47c474368dd3b10318d7024768d010027b9a4
Instruction Fuzzy Hash: 5D21A472A10126AFDB249F25EC41BBB73E8EB84314F50007FE905D6242EB78AD94CB58

Uniqueness

Uniqueness Score: -1.00%

Function 049C07D5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FDF
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FEC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 049C0829

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 07176d041ccb76ae88aba79526e47c474368dd3b10318d7024768d010027b9a4
Instruction ID: 170abc35d800a3819d4411c89bd109f7c6a6f8928fc10c51885a807ff018e2bf
Opcode Fuzzy Hash: 07176d041ccb76ae88aba79526e47c474368dd3b10318d7024768d010027b9a4
Instruction Fuzzy Hash: 4E214172510246EBEB28AF64DC41BBA73ACEB44314F10417EED05D6140EB76B944CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 004201F6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(0042031E,00000001), ref: 00420268

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 99b2f876620ac10c6ca92bde749c113f34e51ea65ef0bdbea7568b5c98a300cc
Instruction ID: 49ba2386fd56472b937459dedd44369b9cff9a6b43f8a10f8929f2f22ea22f3a
Opcode Fuzzy Hash: 99b2f876620ac10c6ca92bde749c113f34e51ea65ef0bdbea7568b5c98a300cc
Instruction Fuzzy Hash: C211593A3003048FDB189F79E8955BABBD1FF80358B54442EE94647B41D775AC43CB54

Uniqueness

Uniqueness Score: -1.00%

Function 049C045D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

EnumSystemLocalesW.KERNEL32(0042031E,00000001), ref: 049C04CF

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 99b2f876620ac10c6ca92bde749c113f34e51ea65ef0bdbea7568b5c98a300cc
Instruction ID: be6d39d530db6240714725be62b873a5798abd23ded34410651eefa927061019
Opcode Fuzzy Hash: 99b2f876620ac10c6ca92bde749c113f34e51ea65ef0bdbea7568b5c98a300cc
Instruction Fuzzy Hash: FE112536600305DFDB189F79D8A06BBBB96FF84318F58443CE98687A40E771B942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0042079E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0042053C,00000000,00000000,?), ref: 004207CA

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 50a760b773673056dd5f151f0344ea9a82e991bd5fc7a466e2a75e8168688c74
Instruction ID: 77b7efbbd9605084933b199ee4511a6e14ac572494e41087e59a71c46a783dd0
Opcode Fuzzy Hash: 50a760b773673056dd5f151f0344ea9a82e991bd5fc7a466e2a75e8168688c74
Instruction Fuzzy Hash: 7DF04932B00131BBDB285A25EC05ABB77E8EB40714F55042FEC05A3641EB78BD41CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 049C0A05 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,049C07A3,00000000,00000000,?), ref: 049C0A31

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 50a760b773673056dd5f151f0344ea9a82e991bd5fc7a466e2a75e8168688c74
Instruction ID: aba13a478761b7ff53e282d1d7f16d9e5ddc6dafc69a9ea06f899c620d6d6c54
Opcode Fuzzy Hash: 50a760b773673056dd5f151f0344ea9a82e991bd5fc7a466e2a75e8168688c74
Instruction Fuzzy Hash: 8EF0F932A10115FFDB245AA58C09BBA77ECEB44714F05047DED45A3140EA74FE41C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 049C07D3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FDF
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FEC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 049C0829

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: dddd9c65e4e1f30298f46963856044f07241dc7bad61ee8d4cc12e79d60ace71
Instruction ID: bb742d11135cbaabe323aae424c0022d0a06c580b27509d3d4c3d5abf45b066a
Opcode Fuzzy Hash: dddd9c65e4e1f30298f46963856044f07241dc7bad61ee8d4cc12e79d60ace71
Instruction Fuzzy Hash: 5DF0C832A51209EBEB14AF74DC81EFA73ACDB84314F0041BEEA06D7240DA75BD0587D5

Uniqueness

Uniqueness Score: -1.00%

Function 00420291 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(0042056E,00000001), ref: 004202DD

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 113be6f81e3035ef4094f513c827c8a5482bca16cbeb68e33c29e2227a471707
Instruction ID: f4d74bd71e075134b08b3162c017dc50aec929530ee89942bdaa7194291eeec2
Opcode Fuzzy Hash: 113be6f81e3035ef4094f513c827c8a5482bca16cbeb68e33c29e2227a471707
Instruction Fuzzy Hash: 8EF028363003149FD7249F39E88567B7BD1EF80358B55806FF9418B681D6B5DC42CA14

Uniqueness

Uniqueness Score: -1.00%

Function 049C04F8 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

EnumSystemLocalesW.KERNEL32(0042056E,00000001), ref: 049C0544

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 113be6f81e3035ef4094f513c827c8a5482bca16cbeb68e33c29e2227a471707
Instruction ID: 34521a53f9d27d0aa4e61fa685ebf22c5a42c879436fd99105771e3aad54d1a3
Opcode Fuzzy Hash: 113be6f81e3035ef4094f513c827c8a5482bca16cbeb68e33c29e2227a471707
Instruction Fuzzy Hash: B8F0C2363003449FDB249F7A9880A7A7B95EF8176CF15447DF9468B680D6B1E842DA40

Uniqueness

Uniqueness Score: -1.00%

Function 049B774B Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,049B4002,?,00000004), ref: 049B779E

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d06c81f9051624123f0240a2e40fa32804307ea5612c10cef1e8800cd83b6813
Instruction ID: ba882c9dc14cd468dbb3b4fddbedea4ce648d410fee3f05af8a5faed7e3bf5ba
Opcode Fuzzy Hash: d06c81f9051624123f0240a2e40fa32804307ea5612c10cef1e8800cd83b6813
Instruction Fuzzy Hash: 31F0C231741218BBEB11AFA1EC01AAE3B66EF88711F9005BABC4926150CE716D2096C8

Uniqueness

Uniqueness Score: -1.00%

Function 004170F1 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 004119FB: EnterCriticalSection.KERNEL32(?,?,00416AB9,?,00437EC8,00000008,00416B87,?,?,?), ref: 00411A0A

EnumSystemLocalesW.KERNEL32(Function_000170AB,00000001,00437F48,0000000C), ref: 00417129

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7d14fc4c37ba5c1eb5f5789ac7718501883f28f806716e35bc2b7c397605f316
Instruction ID: 478c96efee8cf35dcbe40c2a7d162aedb82ec0696934307ef213c81b3e450308
Opcode Fuzzy Hash: 7d14fc4c37ba5c1eb5f5789ac7718501883f28f806716e35bc2b7c397605f316
Instruction Fuzzy Hash: 82F03C72A90200AFDB14EF69D846B9D3BF0AB04724F10526AF414DB2E6CB788990CB49

Uniqueness

Uniqueness Score: -1.00%

Function 049B7358 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 049B1C62: RtlEnterCriticalSection.NTDLL(?), ref: 049B1C71

EnumSystemLocalesW.KERNEL32(004170AB,00000001,00437F48,0000000C), ref: 049B7390

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7d14fc4c37ba5c1eb5f5789ac7718501883f28f806716e35bc2b7c397605f316
Instruction ID: bbfbaa9a7d794f32d35b6c3791becca2341f0d62839b05ebd26f11af9591b811
Opcode Fuzzy Hash: 7d14fc4c37ba5c1eb5f5789ac7718501883f28f806716e35bc2b7c397605f316
Instruction Fuzzy Hash: DEF04F72A903049FE715EF68D945B9D37F0FB44714F105279E844DB2E4CBB459508B89

Uniqueness

Uniqueness Score: -1.00%

Function 004201AB Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

EnumSystemLocalesW.KERNEL32(00420102,00000001), ref: 004201E2

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: dc6ba866eb16a0e8202ac78c3c659fb354344be393a1c2857dc08766edbf3baa
Instruction ID: db6231e4cc46389b928d3f68502c6f4218c27f8c43fece57adf930b758dd991b
Opcode Fuzzy Hash: dc6ba866eb16a0e8202ac78c3c659fb354344be393a1c2857dc08766edbf3baa
Instruction Fuzzy Hash: 44F0553A30022457CB089F3AEC0567A7FD1FFC1714B46005EEA058B282C6BAD853CB98

Uniqueness

Uniqueness Score: -1.00%

Function 049C0412 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

EnumSystemLocalesW.KERNEL32(00420102,00000001), ref: 049C0449

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: dc6ba866eb16a0e8202ac78c3c659fb354344be393a1c2857dc08766edbf3baa
Instruction ID: 7a553a9ca635185df9a8165647e79e94f46211e153639b83d4e27e2616e09523
Opcode Fuzzy Hash: dc6ba866eb16a0e8202ac78c3c659fb354344be393a1c2857dc08766edbf3baa
Instruction Fuzzy Hash: 1EF0553630020497CB049F79DC0577B7F94FFC1714F46006DEA498B282C631A843C790

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009C12,00409378), ref: 00409C0B

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 37a89dbd94a541d6949a367454bd87e5f81fc4fb93678faef82d160b6c7e219e
Instruction ID: 45d68350dde52a3f41bb3cfd9e0ee1303ce9557964324acffd0e2deaa38d85f0
Opcode Fuzzy Hash: 37a89dbd94a541d6949a367454bd87e5f81fc4fb93678faef82d160b6c7e219e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 049A9E6D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409C12,049A95DF), ref: 049A9E72

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 37a89dbd94a541d6949a367454bd87e5f81fc4fb93678faef82d160b6c7e219e
Instruction ID: 45d68350dde52a3f41bb3cfd9e0ee1303ce9557964324acffd0e2deaa38d85f0
Opcode Fuzzy Hash: 37a89dbd94a541d6949a367454bd87e5f81fc4fb93678faef82d160b6c7e219e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00420AEA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00420AEA

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 08acb3965b4031bea61f5245200d95e2e98c400d10a9d016c552db6a4b8cc508
Instruction ID: dcfa98a66e4e9bf543eb7ea8158f1a80588cd166686440bcbd93925ea0cb4c42
Opcode Fuzzy Hash: 08acb3965b4031bea61f5245200d95e2e98c400d10a9d016c552db6a4b8cc508
Instruction Fuzzy Hash: 11A02430701100CF73104F305D4470C37D55D441D134D003C5004C0030DF3040D4D70D

Uniqueness

Uniqueness Score: -1.00%

Function 02F1F06B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3336518839.0000000002F1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2f1e000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: af8cf2d1c07b9df474c1408f20be214e3105ab339cff6c472099303436dc7ac2
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 4711CE72340200AFE700DF55DC80FA273EAEB98760B598165EE09CB756E676E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 049A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 08bf4ebb94c0f538efd1de4de9913848979eb4e2ae1fbc4f53616679c6c078d3
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5001A277A016049FDF21CF24C808BAA33E9EB86216F5544B9E90A9B281E774B9518BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00411F6A Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00411FDA
_free.LIBCMT ref: 00411FF0
_free.LIBCMT ref: 00412001
_free.LIBCMT ref: 00412012
_free.LIBCMT ref: 00412029
GetCPInfo.KERNEL32(?,?), ref: 00412071

Part of subcall function 0041B14E: _free.LIBCMT ref: 0041B1B9

_free.LIBCMT ref: 0041221D
_free.LIBCMT ref: 00412230
_free.LIBCMT ref: 0041223E
_free.LIBCMT ref: 00412249
_free.LIBCMT ref: 0041228B
_free.LIBCMT ref: 00412293
_free.LIBCMT ref: 0041229B
_free.LIBCMT ref: 004122A3
_free.LIBCMT ref: 004122B1

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 9d037bec24c39842fdb41d63d06b61860568da7267ea86be451b4e4681316e80
Instruction ID: 8ae6142132af87c7e5682a7a588f5480999d86aced5f895244e8bf3117bae5a7
Opcode Fuzzy Hash: 9d037bec24c39842fdb41d63d06b61860568da7267ea86be451b4e4681316e80
Instruction Fuzzy Hash: 0DB1C171900309AFDB10DF65C881BEEBBF5BF48304F14416EF959E7242D7B9A8918B64

Uniqueness

Uniqueness Score: -1.00%

Function 049B21D1 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 049B2241
_free.LIBCMT ref: 049B2257
_free.LIBCMT ref: 049B2268
_free.LIBCMT ref: 049B2279
_free.LIBCMT ref: 049B2290
GetCPInfo.KERNEL32(?,?), ref: 049B22D8

Part of subcall function 049BB3B5: _free.LIBCMT ref: 049BB420

_free.LIBCMT ref: 049B2484
_free.LIBCMT ref: 049B2497
_free.LIBCMT ref: 049B24A5
_free.LIBCMT ref: 049B24B0
_free.LIBCMT ref: 049B24F2
_free.LIBCMT ref: 049B24FA
_free.LIBCMT ref: 049B2502
_free.LIBCMT ref: 049B250A
_free.LIBCMT ref: 049B2518

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: e97052e7d5d39c2e49c6ef11ebcd5deb8362bed3d67f9f3722abe09ca1aa8c7f
Instruction ID: 8331340fea7f2ffa8c7bf94e1e5268b9fc83ca2ea3728e75efb89ea182da6b84
Opcode Fuzzy Hash: e97052e7d5d39c2e49c6ef11ebcd5deb8362bed3d67f9f3722abe09ca1aa8c7f
Instruction Fuzzy Hash: 58B1BF719002059FEB21DFB4C984BEEBBB9FF49304F1440B9E995AB241DB75B841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041F521 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041F565

Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8D1
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8E3
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8F5
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E907
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E919
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E92B
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E93D
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E94F
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E961
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E973
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E985
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E997
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E9A9

_free.LIBCMT ref: 0041F55A

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F57C
_free.LIBCMT ref: 0041F591
_free.LIBCMT ref: 0041F59C
_free.LIBCMT ref: 0041F5BE
_free.LIBCMT ref: 0041F5D1
_free.LIBCMT ref: 0041F5DF
_free.LIBCMT ref: 0041F5EA
_free.LIBCMT ref: 0041F622
_free.LIBCMT ref: 0041F629
_free.LIBCMT ref: 0041F646
_free.LIBCMT ref: 0041F65E

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction ID: 316693fb469aea39a39253a8fd8e6cc64fc1a93db8be5688e07109e7d5df04fe
Opcode Fuzzy Hash: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction Fuzzy Hash: 33316C71500700AFEB20AE7AE845BD773E9FF44318F15446BE849D7262DA79ECC68A18

Uniqueness

Uniqueness Score: -1.00%

Function 049BF788 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 049BF7CC

Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB38
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB4A
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB5C
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB6E
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB80
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEB92
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBA4
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBB6
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBC8
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBDA
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBEC
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEBFE
Part of subcall function 049BEB1B: _free.LIBCMT ref: 049BEC10

_free.LIBCMT ref: 049BF7C1

Part of subcall function 049B6501: HeapFree.KERNEL32(00000000,00000000,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?), ref: 049B6517
Part of subcall function 049B6501: GetLastError.KERNEL32(?,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?,?), ref: 049B6529

_free.LIBCMT ref: 049BF7E3
_free.LIBCMT ref: 049BF7F8
_free.LIBCMT ref: 049BF803
_free.LIBCMT ref: 049BF825
_free.LIBCMT ref: 049BF838
_free.LIBCMT ref: 049BF846
_free.LIBCMT ref: 049BF851
_free.LIBCMT ref: 049BF889
_free.LIBCMT ref: 049BF890
_free.LIBCMT ref: 049BF8AD
_free.LIBCMT ref: 049BF8C5

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction ID: 41ffcec3a3caa8161d5ad9816a8ac71e7702d5bb8895244aa3338f61fc649f8a
Opcode Fuzzy Hash: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction Fuzzy Hash: B9315B326002019FEB30AA78DE84BDAB3E9EF81714F108479E4DAD6154DF72F950C792

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B2 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E9FA
_free.LIBCMT ref: 0041EA1E
_free.LIBCMT ref: 0041EA2B
_free.LIBCMT ref: 0041EA50
_free.LIBCMT ref: 0041EA5D
_free.LIBCMT ref: 0041EA66
_free.LIBCMT ref: 0041ED44
_free.LIBCMT ref: 0041ED4C

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ede1a756fe7c81b57652e01e6694f4d5898de535ff9c24b5680a7aebf79362e9
Instruction ID: 728dd4b73fa8875da2944d3c1161fea0547f625c3b5c38e136dc442d3870b7dc
Opcode Fuzzy Hash: ede1a756fe7c81b57652e01e6694f4d5898de535ff9c24b5680a7aebf79362e9
Instruction Fuzzy Hash: 63C16376D40204BBDB20DFA9CC43FDA77F8AB48744F15416AFE05EB282E6749D818794

Uniqueness

Uniqueness Score: -1.00%

Function 00423226 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042422F), ref: 00423249

Strings

asin, xrefs: 004233B5
exp, xrefs: 0042330E, 00423370
acos, xrefs: 004233C1
log10, xrefs: 00423293, 004232E3
/BB, xrefs: 0042342E
sqrt, xrefs: 004233CD
pow, xrefs: 0042332D, 004233D9, 004233EC
log, xrefs: 004232EF, 004232FB

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: DecodePointer
String ID: /BB$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-1021189420
Opcode ID: 88552b8886f88d94b8d1bbcc7aafbfab123f3002aa15034899b0489058aea16a
Instruction ID: 5f418b0c94ccf72204288f9fbe243b868e613e1cea8606976bda72b47a9d9e27
Opcode Fuzzy Hash: 88552b8886f88d94b8d1bbcc7aafbfab123f3002aa15034899b0489058aea16a
Instruction Fuzzy Hash: 06518E70B00529CBDB10DFA9F9481AD7BB0FB49305FE44197E881A6254CB7D8B65CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C25 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416C39

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 00416C45
_free.LIBCMT ref: 00416C50
_free.LIBCMT ref: 00416C5B
_free.LIBCMT ref: 00416C66
_free.LIBCMT ref: 00416C71
_free.LIBCMT ref: 00416C7C
_free.LIBCMT ref: 00416C87
_free.LIBCMT ref: 00416C92
_free.LIBCMT ref: 00416CA0

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction ID: 425b14d8582b8484cae793816d5f4fa8e3af98928aded5048720e3a5ca7bcabf
Opcode Fuzzy Hash: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction Fuzzy Hash: B311E976100218BFDF01FF95D952DD93B65EF48358B4280AAFD088F222DA35EE919B84

Uniqueness

Uniqueness Score: -1.00%

Function 049B6E8C Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 049B6EA0

Part of subcall function 049B6501: HeapFree.KERNEL32(00000000,00000000,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?), ref: 049B6517
Part of subcall function 049B6501: GetLastError.KERNEL32(?,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?,?), ref: 049B6529

_free.LIBCMT ref: 049B6EAC
_free.LIBCMT ref: 049B6EB7
_free.LIBCMT ref: 049B6EC2
_free.LIBCMT ref: 049B6ECD
_free.LIBCMT ref: 049B6ED8
_free.LIBCMT ref: 049B6EE3
_free.LIBCMT ref: 049B6EEE
_free.LIBCMT ref: 049B6EF9
_free.LIBCMT ref: 049B6F07

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction ID: 7c6040527e50687947d58a5f71d497b5ca04023fed903145fa615603548af91e
Opcode Fuzzy Hash: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction Fuzzy Hash: 5811D775100008BFDB11EF94CA40CD93BA5EF55758B0184B1FA488B124DA72FE60DB82

Uniqueness

Uniqueness Score: -1.00%

Function 004011B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004011B5
std::_Lockit::_Lockit.LIBCPMT ref: 004011C7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00401204

Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407E99
Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407EBD

std::bad_exception::bad_exception.LIBCMT ref: 00401225
__CxxThrowException@8.LIBVCRUNTIME ref: 00401233
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00401256
std::_Lockit::~_Lockit.LIBCPMT ref: 004012C7

Strings

bad locale name, xrefs: 0040121D

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 835844855-1405518554
Opcode ID: 5bb5d50ea43f12d9519b4ce9e87ae728e2dc9a994e3de2c5b5b0931fcb6b1e5a
Instruction ID: 9bdc7579a9a3bc6ca601cd004726ed2944731520d9260611c740ec4211b797ca
Opcode Fuzzy Hash: 5bb5d50ea43f12d9519b4ce9e87ae728e2dc9a994e3de2c5b5b0931fcb6b1e5a
Instruction Fuzzy Hash: 5D319F31904B40DEC731AF6AD941A5BFBF4BF08714B508A7FE04AA3AA1C738B504CB59

Uniqueness

Uniqueness Score: -1.00%

Function 049A43F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A43F5
std::_Lockit::_Lockit.LIBCPMT ref: 049A4404
int.LIBCPMT ref: 049A441B

Part of subcall function 049A157F: std::_Lockit::_Lockit.LIBCPMT ref: 049A1590
Part of subcall function 049A157F: std::_Lockit::~_Lockit.LIBCPMT ref: 049A15AA

std::locale::_Getfacet.LIBCPMT ref: 049A4424
std::_Facet_Register.LIBCPMT ref: 049A4455
std::_Lockit::~_Lockit.LIBCPMT ref: 049A446B
__CxxThrowException@8.LIBVCRUNTIME ref: 049A4491

Strings

_vB, xrefs: 049A43F0

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction ID: 277c7309fba470eaccd2a62f26832c7b919553be32ed625d442fb9be69369aa7
Opcode Fuzzy Hash: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction Fuzzy Hash: 651127329001188BDB05EBA4DC01AEDB7B9EFC4358F14047EE815A7290DB70FA11CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 049A3651 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A3656
std::_Lockit::_Lockit.LIBCPMT ref: 049A3665
int.LIBCPMT ref: 049A367C

Part of subcall function 049A157F: std::_Lockit::_Lockit.LIBCPMT ref: 049A1590
Part of subcall function 049A157F: std::_Lockit::~_Lockit.LIBCPMT ref: 049A15AA

std::locale::_Getfacet.LIBCPMT ref: 049A3685
std::_Facet_Register.LIBCPMT ref: 049A36B6
std::_Lockit::~_Lockit.LIBCPMT ref: 049A36CC
__CxxThrowException@8.LIBVCRUNTIME ref: 049A36F2

Strings

_vB, xrefs: 049A3651

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction ID: 1a6394f28eb91bf9f3c89cb3330dc9f3a470ec450bbec6def6aad925e1f64743
Opcode Fuzzy Hash: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction Fuzzy Hash: 051106729001249BDB15EFA4C806AEE7779EFC4354F18047AE811A7290DB74AA10C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 049A385C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A3861
std::_Lockit::_Lockit.LIBCPMT ref: 049A3870
int.LIBCPMT ref: 049A3887

Part of subcall function 049A157F: std::_Lockit::_Lockit.LIBCPMT ref: 049A1590
Part of subcall function 049A157F: std::_Lockit::~_Lockit.LIBCPMT ref: 049A15AA

std::locale::_Getfacet.LIBCPMT ref: 049A3890
std::_Facet_Register.LIBCPMT ref: 049A38C1
std::_Lockit::~_Lockit.LIBCPMT ref: 049A38D7
__CxxThrowException@8.LIBVCRUNTIME ref: 049A38FD

Strings

_vB, xrefs: 049A385C

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction ID: d6c5d2d2fab64dd1c190525c116ac08f437db0551ff78cd3e51053f68bcbce58
Opcode Fuzzy Hash: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction Fuzzy Hash: 7A110672E001249BDB15EBA8C805AEDB779EFC4758F14047AE811A7290DF74EA14CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 049B9514 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c333506b60f9a2cbe16c25422fb5c8dc001c6824b257e592f442b80053a19a3
Instruction ID: 3006d8287b6cae361a5103408ca51f8dc2a0dcd7f71cc8485dc5f35be3c8443c
Opcode Fuzzy Hash: 1c333506b60f9a2cbe16c25422fb5c8dc001c6824b257e592f442b80053a19a3
Instruction Fuzzy Hash: 5FC1C4B0A142499FDF11DFA8CA84BED7BF4AF4A314F0845A4DAC0A7391C774A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414A4A Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

_memcmp.LIBVCRUNTIME ref: 00414CF4
_free.LIBCMT ref: 00414D65
_free.LIBCMT ref: 00414D7E
_free.LIBCMT ref: 00414DB0
_free.LIBCMT ref: 00414DB9
_free.LIBCMT ref: 00414DC5

Strings

C, xrefs: 00414BB2

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 8f87c09ea476144f3408270848766069dd2a72959f888511d1f2eb11bfac3621
Instruction ID: af268d229fb851bfdfa469d3d7016fc6fe3b7b40d7c0f50ff16bf374563e7c73
Opcode Fuzzy Hash: 8f87c09ea476144f3408270848766069dd2a72959f888511d1f2eb11bfac3621
Instruction Fuzzy Hash: 7CB12975A016199BDB24DF18D884BEEB7B4FF88304F6045AAE809A7350E735AED1CF44

Uniqueness

Uniqueness Score: -1.00%

Function 049B4CB1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 049B6F80: GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
Part of subcall function 049B6F80: _free.LIBCMT ref: 049B6FB7
Part of subcall function 049B6F80: SetLastError.KERNEL32(00000000), ref: 049B6FF8
Part of subcall function 049B6F80: _abort.LIBCMT ref: 049B6FFE

_memcmp.LIBVCRUNTIME ref: 049B4F5B
_free.LIBCMT ref: 049B4FCC
_free.LIBCMT ref: 049B4FE5
_free.LIBCMT ref: 049B5017
_free.LIBCMT ref: 049B5020
_free.LIBCMT ref: 049B502C

Strings

C, xrefs: 049B4E19

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 2dcdab9ff37da07fbf13cf7196123cc144f196f64e2833b55e76e053da9afdf4
Instruction ID: 4a4c8230e95ed9dac8b8627b621b8f59315fa95b196210839550a75693a2313e
Opcode Fuzzy Hash: 2dcdab9ff37da07fbf13cf7196123cc144f196f64e2833b55e76e053da9afdf4
Instruction Fuzzy Hash: 73B13975A012199FDB24DF18C988AEDB7B5FF48304F1045AAD989A7351E731BE90CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0041673F Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0040F850,0040F850,?,?,?,00416990,00000001,00000001,F5E85006), ref: 00416799
__alloca_probe_16.LIBCMT ref: 004167D1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00416990,00000001,00000001,F5E85006,?,?,?), ref: 0041681F
__alloca_probe_16.LIBCMT ref: 004168B6
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00416919
__freea.LIBCMT ref: 00416926

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

__freea.LIBCMT ref: 0041692F
__freea.LIBCMT ref: 00416954

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: f9eec1d03ef488200257542b3a30a4a1c023565d73c6751b204851a68cbc467a
Instruction ID: 3d3e7015d1c5c7bc026f1fbb08fe6865a4c6ffd2cfadb9c0ba95752873af972a
Opcode Fuzzy Hash: f9eec1d03ef488200257542b3a30a4a1c023565d73c6751b204851a68cbc467a
Instruction Fuzzy Hash: 4751F5B2610216ABDB259F65CC41EFF7BA9EF40754F16462EFD04D6280DB38DC80C668

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDD7 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041EE46
_free.LIBCMT ref: 0041EE54
_free.LIBCMT ref: 0041EF82
_free.LIBCMT ref: 0041EF8D

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e68a25c084fc20a1e1d7f08a61fe8f3dbfc97445b378353a219a7845841ba709
Instruction ID: 73c135ea74765e4518f9d8ef1c60bb5e0d099e6adef79961ba2dbed29d3485ac
Opcode Fuzzy Hash: e68a25c084fc20a1e1d7f08a61fe8f3dbfc97445b378353a219a7845841ba709
Instruction Fuzzy Hash: 8C61A076904305AFDB20DF66C842BDABBF4EF48710F1441ABEC45EB281D7749D828B98

Uniqueness

Uniqueness Score: -1.00%

Function 049BF03E Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 049BF0AD
_free.LIBCMT ref: 049BF0BB
_free.LIBCMT ref: 049BF1E9
_free.LIBCMT ref: 049BF1F4

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f8833a0de0791504dabcccc7c771c2f5db8e414cd847f9ac854e63f406939190
Instruction ID: f3ad225d7b3ebd5a0bbfd890c132c22b732102f0bb9d7946f7911baa349dbda2
Opcode Fuzzy Hash: f8833a0de0791504dabcccc7c771c2f5db8e414cd847f9ac854e63f406939190
Instruction Fuzzy Hash: 13619275900205AFEB20DFA8CD40BDABBF5EB85710F14457AE984EB385DA70B9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00415A13 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,00416188,?,?,?,?,?,?), ref: 00415A55
__fassign.LIBCMT ref: 00415AD0
__fassign.LIBCMT ref: 00415AEB
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 00415B11
WriteFile.KERNEL32(?,?,00000000,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B30
WriteFile.KERNEL32(?,?,00000001,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B69

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ae6401f21b7801d045f97308b9b06165aa02294ae80e5cf11490d6b3e53dbacb
Instruction ID: 407e3908cef374265deb6243eed94e9e176cff0c31ef9f6c7349134872b618e9
Opcode Fuzzy Hash: ae6401f21b7801d045f97308b9b06165aa02294ae80e5cf11490d6b3e53dbacb
Instruction Fuzzy Hash: 725105B0A04608DFDB10CFA8D881AEEBBF8EF49310F14416BE955F3251D774A981CB69

Uniqueness

Uniqueness Score: -1.00%

Function 049B5C7A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,049B63EF,?,?,?,?,?,?), ref: 049B5CBC
__fassign.LIBCMT ref: 049B5D37
__fassign.LIBCMT ref: 049B5D52
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 049B5D78
WriteFile.KERNEL32(?,?,00000000,049B63EF,00000000,?,?,?,?,?,?,?,?,?,049B63EF,?), ref: 049B5D97
WriteFile.KERNEL32(?,?,00000001,049B63EF,00000000,?,?,?,?,?,?,?,?,?,049B63EF,?), ref: 049B5DD0

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bcc7f49e5f9acd1ab4da29e29a7effa70e0c752b6185b76a6d92c3c1d252d699
Instruction ID: 8c0fa287c80cfb5797680772a2b3201819cdcd0b36772a3bf59a506f85345d74
Opcode Fuzzy Hash: bcc7f49e5f9acd1ab4da29e29a7effa70e0c752b6185b76a6d92c3c1d252d699
Instruction Fuzzy Hash: 10510770A00245BFDB10CFA8DD84AEEBBF8EF48314F15456AE585F7250E730A951CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040C7B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040C7DB
___except_validate_context_record.LIBVCRUNTIME ref: 0040C7E3
_ValidateLocalCookies.LIBCMT ref: 0040C871
__IsNonwritableInCurrentImage.LIBCMT ref: 0040C89C
_ValidateLocalCookies.LIBCMT ref: 0040C8F1

Strings

csm, xrefs: 0040C886

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction ID: 3eebbe8c3ad0fa61f276611c5937d4e28261350d7e8d9123906714334ee199f9
Opcode Fuzzy Hash: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction Fuzzy Hash: 59418235E00208DBCB10EF69C880A9EBBB5AF45325F14C27BE8156B3D1D7399945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 049A1417 Relevance: 10.6, APIs: 7, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A141C
std::_Lockit::_Lockit.LIBCPMT ref: 049A142E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 049A146B

Part of subcall function 049A80E1: _Yarn.LIBCPMT ref: 049A8100
Part of subcall function 049A80E1: _Yarn.LIBCPMT ref: 049A8124

std::bad_exception::bad_exception.LIBCMT ref: 049A148C
__CxxThrowException@8.LIBVCRUNTIME ref: 049A149A
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 049A14BD
std::_Lockit::~_Lockit.LIBCPMT ref: 049A152E

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID:
API String ID: 835844855-0
Opcode ID: d4016aa6201875b868c5713db93660535a29781f4af20a4f0b734588d552bf06
Instruction ID: f765c182612f19793781169788f430f0d75caf2257b6ae7a2812afd9a2bfefb9
Opcode Fuzzy Hash: d4016aa6201875b868c5713db93660535a29781f4af20a4f0b734588d552bf06
Instruction Fuzzy Hash: 30317C71800B009FD735AF69D941A5BFBF4FF88714B108A3FE08A82A40CB74B611CB99

Uniqueness

Uniqueness Score: -1.00%

Function 049C6266 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049C626B
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,0043AE60,SOFTWARE\BroomCleaner), ref: 049C6293
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,0043AE60,0043AE61,Installed,Installed), ref: 049C6316
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 049C6337

Strings

Installed, xrefs: 049C6275, 049C62A3, 049C62C2, 049C62C3
SOFTWARE\BroomCleaner, xrefs: 049C6273, 049C6286

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction ID: 1381a84e6d36aec023d04e8699718f223d6b29cac8cc6cfee0e6dd1b6c2d4950
Opcode Fuzzy Hash: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction Fuzzy Hash: EF31AC71A00219EFEB159FA8CC94AFEBB79FB48358F14416DE402B3241C7711D46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004227A8 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3a417481234f6a5cce791f459c1180441bcfe0ab5ce7d00eccf100f1f65345
Instruction ID: 9c8ef9f1e7886cc92e32ce44b389b8283dd6e8511c6332daddb66b94c38c2fe8
Opcode Fuzzy Hash: da3a417481234f6a5cce791f459c1180441bcfe0ab5ce7d00eccf100f1f65345
Instruction Fuzzy Hash: 8E11E7726081257BDB203FB39D059AF3B6CEF92764751062EFC15D6251DEBCC88282B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041EFF3: _free.LIBCMT ref: 0041F01C

_free.LIBCMT ref: 0041F2FA

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F305
_free.LIBCMT ref: 0041F310
_free.LIBCMT ref: 0041F364
_free.LIBCMT ref: 0041F36F
_free.LIBCMT ref: 0041F37A
_free.LIBCMT ref: 0041F385

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction ID: be7813cec9e76b844f682d4c097dbd82c10abeb52ecb146189267b1763b940f2
Opcode Fuzzy Hash: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction Fuzzy Hash: 1F114272541B24B6D920BB72DC07FCBB7DCBF44708F40081EBE9E66052DA7DB5868654

Uniqueness

Uniqueness Score: -1.00%

Function 049BF513 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 049BF25A: _free.LIBCMT ref: 049BF283

_free.LIBCMT ref: 049BF561

Part of subcall function 049B6501: HeapFree.KERNEL32(00000000,00000000,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?), ref: 049B6517
Part of subcall function 049B6501: GetLastError.KERNEL32(?,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?,?), ref: 049B6529

_free.LIBCMT ref: 049BF56C
_free.LIBCMT ref: 049BF577
_free.LIBCMT ref: 049BF5CB
_free.LIBCMT ref: 049BF5D6
_free.LIBCMT ref: 049BF5E1
_free.LIBCMT ref: 049BF5EC

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction ID: 0529f035fda6cd655e4fcde18a2b800dbd0bf69ac4638c740a826ef171399c92
Opcode Fuzzy Hash: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction Fuzzy Hash: A8115472540704AAFA30B7B0CD46FCBBB9D6FC5704F404836A6D9E6054DA65F9148AD1

Uniqueness

Uniqueness Score: -1.00%

Function 00404189 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040418E
std::_Lockit::_Lockit.LIBCPMT ref: 0040419D
int.LIBCPMT ref: 004041B4

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 004041BD
std::_Facet_Register.LIBCPMT ref: 004041EE
std::_Lockit::~_Lockit.LIBCPMT ref: 00404204
__CxxThrowException@8.LIBVCRUNTIME ref: 0040422A

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction ID: 83cc51774d47ba4475a281f6d7b020c526a0fd19fbdba44bd5d3cb2c7b641a00
Opcode Fuzzy Hash: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction Fuzzy Hash: EC110871A001289BCB04EBA4DC06AEE7774EF84358F10057FF915772D1DB389900C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004033EA Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004033EF
std::_Lockit::_Lockit.LIBCPMT ref: 004033FE
int.LIBCPMT ref: 00403415

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 0040341E
std::_Facet_Register.LIBCPMT ref: 0040344F
std::_Lockit::~_Lockit.LIBCPMT ref: 00403465
__CxxThrowException@8.LIBVCRUNTIME ref: 0040348B

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction ID: 705b121528f6e187a552e9d34ae6b3df2024d0ee7a8324a724e42d77b9682124
Opcode Fuzzy Hash: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction Fuzzy Hash: B311C4329001289BCB05EFA8C805AEE7B78EF84359F10452FF811772D1DB789A00CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004035F5 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004035FA
std::_Lockit::_Lockit.LIBCPMT ref: 00403609
int.LIBCPMT ref: 00403620

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 00403629
std::_Facet_Register.LIBCPMT ref: 0040365A
std::_Lockit::~_Lockit.LIBCPMT ref: 00403670
__CxxThrowException@8.LIBVCRUNTIME ref: 00403696

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction ID: 4997e6bde17a0f635c2d016693c2f4113915c820df16c93ef0ac66c49e5cddc6
Opcode Fuzzy Hash: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction Fuzzy Hash: DE11B232A001249BCB14EFA9C805AEE7B78AF44759F10452FF811773D1DB389A04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 049B69A6 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,049B6BF7,00000001,00000001,?), ref: 049B6A00
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,049B6BF7,00000001,00000001,?,?,?,?), ref: 049B6A86
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 049B6B80
__freea.LIBCMT ref: 049B6B8D

Part of subcall function 049B7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 049B7CDE

__freea.LIBCMT ref: 049B6B96
__freea.LIBCMT ref: 049B6BBB

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 0f73ec244de15a6da3a369d6d53f2abaa512a9059a296f3a28781672e1b0d4f4
Instruction ID: 75bc87303b20bd4e5c9cf892a759c77542db72862d23f0ec8860cf324b062460
Opcode Fuzzy Hash: 0f73ec244de15a6da3a369d6d53f2abaa512a9059a296f3a28781672e1b0d4f4
Instruction Fuzzy Hash: C451DE72600226AEEB258F64CE84EFB77BAEB80764B154639EC44D6180EB34FC5086D1

Uniqueness

Uniqueness Score: -1.00%

Function 00411A6C Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00411A98
__cftoe.LIBCMT ref: 00411ACA

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: a485617db110597ec1b9df0d6f289f1fb0bfa04032b722232bc564a93a62f50a
Instruction ID: a06c4f6ae663fca8f796a33128cbcfeb149533fe63f1b311835a711b56a71280
Opcode Fuzzy Hash: a485617db110597ec1b9df0d6f289f1fb0bfa04032b722232bc564a93a62f50a
Instruction Fuzzy Hash: 4951FD72904205ABDF209B699D41EEF77A99F48364F10011FFA15962A2EB3DDD80C65C

Uniqueness

Uniqueness Score: -1.00%

Function 049B1CD3 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 049B1CFF
__cftoe.LIBCMT ref: 049B1D31

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: e4bf59b0ec1b744cc32f8c0c94128242877339c1908a2c1c4c186e4d7dced7e5
Instruction ID: d9b89ddfed0711a3c4d185b159d13c862f938f9c345cc384aff0915f24ba2e17
Opcode Fuzzy Hash: e4bf59b0ec1b744cc32f8c0c94128242877339c1908a2c1c4c186e4d7dced7e5
Instruction Fuzzy Hash: 9F510B72500205ABDF255F598E56AFE77ADAFC93A4F104139E854D6180DF31F940C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9B5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040C9AC,0040A25B), ref: 0040C9C3
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040C9D1
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040C9EA
SetLastError.KERNEL32(00000000,?,0040C9AC,0040A25B), ref: 0040CA3C

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 18b5dec2a50485c169b3661b850eec390da6d2e1189e162841b222e1a78ff080
Instruction ID: 6f2bd147e8afdd7a043ddb4cc032e70cd0d7bbdad2502d4e2c804448eb78ecb9
Opcode Fuzzy Hash: 18b5dec2a50485c169b3661b850eec390da6d2e1189e162841b222e1a78ff080
Instruction Fuzzy Hash: 3D01F57260D215AEE63857B5BDC5B6B2665DB01378320033FF214B02F0EEBD4C06955C

Uniqueness

Uniqueness Score: -1.00%

Function 049ACC1C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,049ACC13,049AA4C2), ref: 049ACC2A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 049ACC38
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 049ACC51
SetLastError.KERNEL32(00000000,?,049ACC13,049AA4C2), ref: 049ACCA3

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 830170af9e05d3dbdbf0f1320e03d58499cc30579d0bb48bb262cb75337020d8
Instruction ID: 380a1597fa2b49040cf0465674fa652ad000957be89a29ea7e8632791fb88707
Opcode Fuzzy Hash: 830170af9e05d3dbdbf0f1320e03d58499cc30579d0bb48bb262cb75337020d8
Instruction Fuzzy Hash: A801FC322093215EB7282B75BD8C9AB3B7AEB41A797300B3DF124DA4F0EF516C2195C4

Uniqueness

Uniqueness Score: -1.00%

Function 00416D19 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
_free.LIBCMT ref: 00416D50
_free.LIBCMT ref: 00416D78
SetLastError.KERNEL32(00000000), ref: 00416D85
SetLastError.KERNEL32(00000000), ref: 00416D91
_abort.LIBCMT ref: 00416D97

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction ID: 67229b3f983384f7021419eb0c05c433d1635833c178197dce61a7b79ae5b6d3
Opcode Fuzzy Hash: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction Fuzzy Hash: E1F0A931784B1026C61177367C09BDF27295FC1765B27092FF518A2291EE7CDCC6815D

Uniqueness

Uniqueness Score: -1.00%

Function 049B6F80 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,049AE697,?,?,?,049AED94,?), ref: 049B6F84
_free.LIBCMT ref: 049B6FB7
_free.LIBCMT ref: 049B6FDF
SetLastError.KERNEL32(00000000), ref: 049B6FEC
SetLastError.KERNEL32(00000000), ref: 049B6FF8
_abort.LIBCMT ref: 049B6FFE

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction ID: 626efd70daee6bff292cd57dc75995d392f5e15d30baa3cf9dd0dcd6864cfe20
Opcode Fuzzy Hash: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction Fuzzy Hash: C6F0F9312895102AD72133796E08BEF35199BC1765F250934F5D4D21D0EE60BC1685E7

Uniqueness

Uniqueness Score: -1.00%

Function 049A37D6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A37DB

Strings

Installed, xrefs: 049A37E4
/ping.php?substr=%s, xrefs: 049A37E3
185.172.128.228, xrefs: 049A37E2
qvB, xrefs: 049A37D6

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed$qvB
API String ID: 3519838083-3387484886
Opcode ID: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction ID: 4ed89d5d354ac7b1511bf39140bba7ab00b1cbe2d7d01beeca1329c5c9f20640
Opcode Fuzzy Hash: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction Fuzzy Hash: 1701C0B2A01515BBE7149F88DC40BAEB7B8FF85718F10053AFC05D7240D370AA608AE1

Uniqueness

Uniqueness Score: -1.00%

Function 00417253 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,-@,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue), ref: 00417285
GetLastError.KERNEL32(?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042E2F0,FlsSetValue,00000000,00000364,?,00416DEB), ref: 00417291
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042E2F0,FlsSetValue,00000000), ref: 0041729F

Strings

-@, xrefs: 0041727C

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: -@
API String ID: 3177248105-2564449678
Opcode ID: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction ID: 4020431c692cdd365c1edb7e0a14a8f9a79106a1dcbffcc21bafc0d3a38fe4c7
Opcode Fuzzy Hash: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction Fuzzy Hash: 3A012B3674A6229BC7314B699C449DB7BB8AF457B07110676F90AD7240CB38D847C6EC

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

ios_base::badbit set, xrefs: 00401890, 004018B1
ios_base::eofbit set, xrefs: 004018A0
ios_base::failbit set, xrefs: 0040189B, 004018D2

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction ID: e5a36d636a31146743a29846f322d727076c10bf51cb576a0d0ebd87300f877c
Opcode Fuzzy Hash: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction Fuzzy Hash: 54F0AFA290035C63DB10B9659802BEA7B989F09358F24803BFD45761E1DA795A04C6ED

Uniqueness

Uniqueness Score: -1.00%

Function 049A1AE6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 049A1B30
std::system_error::system_error.LIBCPMT ref: 049A1B3F

Strings

ios_base::eofbit set, xrefs: 049A1B07
ios_base::failbit set, xrefs: 049A1B02, 049A1B39
ios_base::badbit set, xrefs: 049A1AF7, 049A1B18

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction ID: 645539fb5ab5695b935d82371fd8e226f781b592e9285c3f8c1b56c194b90bd6
Opcode Fuzzy Hash: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction Fuzzy Hash: 9DF02BB190032C77DB10AA949C42FD97B9C9F08394F148036FD446B194F7B4BA24C3E8

Uniqueness

Uniqueness Score: -1.00%

Function 00413A6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002), ref: 00413A8C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00413A9F
FreeLibrary.KERNEL32(00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002,00000000), ref: 00413AC2

Strings

mscoree.dll, xrefs: 00413A85
CorExitProcess, xrefs: 00413A97

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9ab9df708068ff77d02737265f27547bccff245a6d09e8574e118d44c2a6cbc
Instruction ID: 7ce0cb3fbee047f4a8559af6233cdb304d6a34e640ed2fcc4eaf65fddaef0d9f
Opcode Fuzzy Hash: e9ab9df708068ff77d02737265f27547bccff245a6d09e8574e118d44c2a6cbc
Instruction Fuzzy Hash: F0F04431A01118BBDB119F94DC09BDEBFB8EF44752F5540AAF809A2290DF785E85CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A950 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction ID: 6ea283d57a609fffab434fde2135b7d270b6c6f02c2325d1109ee2994591e76b
Opcode Fuzzy Hash: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction Fuzzy Hash: AE7129719062969BCB308F94C844AFFBB76FF41360F14022BE91457280D778ACE1C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 049BABB7 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction ID: 1fd8c521d924931fa7cf402eb3197ef91c5af6e9e03f00527aadd467a7ab7dbf
Opcode Fuzzy Hash: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction Fuzzy Hash: 16717E31A0021A9BDF318F54CE88AFEBB79EF81361F154639E89167140DBB0A945C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 004145CC Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

_free.LIBCMT ref: 004146D7
_free.LIBCMT ref: 004146EE
_free.LIBCMT ref: 0041470D
_free.LIBCMT ref: 00414728
_free.LIBCMT ref: 0041473F

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 7e145fb4ba94dc3237958cad872b9e908e7f7c9f1f6bf31c302f80a0328396d6
Instruction ID: 1364ae8c8bed3babfbeb70cadbec98ce06422c2098a54f189f7d31eb1db71690
Opcode Fuzzy Hash: 7e145fb4ba94dc3237958cad872b9e908e7f7c9f1f6bf31c302f80a0328396d6
Instruction Fuzzy Hash: 7251E571A00304AFDB20DF65D881BAA77F5EF99728F14056EE809D7690E739ED81CB48

Uniqueness

Uniqueness Score: -1.00%

Function 049B4833 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 049B7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 049B7CDE

_free.LIBCMT ref: 049B493E
_free.LIBCMT ref: 049B4955
_free.LIBCMT ref: 049B4974
_free.LIBCMT ref: 049B498F
_free.LIBCMT ref: 049B49A6

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: d20824fdcacda83af1664dbc103671d64a4d903058c6e02df8cb7ef10616926c
Instruction ID: 918f8e29f24ad51f8da2278f41719e9a769749afeee0d5fbaf72455b108ae269
Opcode Fuzzy Hash: d20824fdcacda83af1664dbc103671d64a4d903058c6e02df8cb7ef10616926c
Instruction Fuzzy Hash: A651B431A00204AFEB21DF65CE80AAA77F9EF85B24B14457DE889D7251E731F911DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00415063 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004150D5
_free.LIBCMT ref: 004150F5

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction ID: 8cf76a1bb0839b7cd8128bcbec6e1cebe900e569fbfc9cf9c78d37498cff2dcd
Opcode Fuzzy Hash: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction Fuzzy Hash: B241E032E00700EBCB15DFB9C880ADEB7B5EF89314B1185AAE515EB382D734AD41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 049B52CA Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 049B533C
_free.LIBCMT ref: 049B535C

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction ID: 23079ae3b62eeae68555bd90573e4c9bbb9dbbdfd079f1747331085e108ab9ae
Opcode Fuzzy Hash: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction Fuzzy Hash: BE41B236A00300EFDB14DF78C980A99B7A5EF85728F564579D555EB390D771BD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0041B300 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0041197C,?,00000000,?,00000001,?,?,00000001,0041197C,?), ref: 0041B34D
__alloca_probe_16.LIBCMT ref: 0041B385
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0041B3D6
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00410DD1,?), ref: 0041B3E8
__freea.LIBCMT ref: 0041B3F1

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 23a3252cb5aa1ceb9cf1dbfe047612e0e4775c8e4192d68e8df02371e9c4781d
Instruction ID: 9ad45024e657c6c1581d72c25b5196d30cf145d3c6dba1e906db6810fcdec08f
Opcode Fuzzy Hash: 23a3252cb5aa1ceb9cf1dbfe047612e0e4775c8e4192d68e8df02371e9c4781d
Instruction Fuzzy Hash: 0831CE32A0021AABDB248F65CC41DEF7BA5EF40314B05412EFC14E6291EB39DDA5CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E403 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041E40C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E42F

Part of subcall function 00417A45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0041E455
_free.LIBCMT ref: 0041E468
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041E477

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d21167a4ec00cfc2ded7cff180726697e6523b003ed2d29391144b3d5a9b389e
Instruction ID: 3801774db5af9eb9c78c35188b4f65337a3fd4a66a09e05ac0132405ac606614
Opcode Fuzzy Hash: d21167a4ec00cfc2ded7cff180726697e6523b003ed2d29391144b3d5a9b389e
Instruction Fuzzy Hash: C70188766022157B27211A775C4CCBF6A6DDEC6FE4315012EBD08C3200DE788C8685BD

Uniqueness

Uniqueness Score: -1.00%

Function 049BE66A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 049BE673
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 049BE696

Part of subcall function 049B7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 049B7CDE

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 049BE6BC
_free.LIBCMT ref: 049BE6CF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 049BE6DE

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d19c47060a10e2cafe652fe0b9a9a3538350b76910d5e87ed89a6a6c5fab3348
Instruction ID: 6d4d4bae48b0dcf28dd5ce4c651c56788a60c72ee39cd7c995a2b7b88742f15d
Opcode Fuzzy Hash: d19c47060a10e2cafe652fe0b9a9a3538350b76910d5e87ed89a6a6c5fab3348
Instruction Fuzzy Hash: 3501D472702215BB2B3116B65D88CFF6A6DDAC2AE1315013DBD44C2200EE65AC0681F9

Uniqueness

Uniqueness Score: -1.00%

Function 00416D9D Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00412386,004170A0,?,00416D47,00000001,00000364,?,0040E430,?,?,?,0040EB2D,?), ref: 00416DA2
_free.LIBCMT ref: 00416DD7
_free.LIBCMT ref: 00416DFE
SetLastError.KERNEL32(00000000), ref: 00416E0B
SetLastError.KERNEL32(00000000), ref: 00416E14

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction ID: 590f77e2bb6cf6723b3ae76f6f4a9e52eee2512f3abf58083b79aa59d1bf9a60
Opcode Fuzzy Hash: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction Fuzzy Hash: 540149363847202B82213676BC45EEB26299BC1374723057FF419A22C2EF7CCC96802C

Uniqueness

Uniqueness Score: -1.00%

Function 049B7004 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,049B25ED,049B7307,?,049B6FAE,00000001,00000364,?,049AE697,?,?,?,049AED94,?), ref: 049B7009
_free.LIBCMT ref: 049B703E
_free.LIBCMT ref: 049B7065
SetLastError.KERNEL32(00000000), ref: 049B7072
SetLastError.KERNEL32(00000000), ref: 049B707B

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction ID: f17f115f0dd010d0f2a2b25c5c1b2b1c9407a3ab37ca376d6882234f012da347
Opcode Fuzzy Hash: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction Fuzzy Hash: 42014976240E003B97322BF81E84EEF221EABC127472107BAF495A2180FE74BC0680E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED6E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED86

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041ED98
_free.LIBCMT ref: 0041EDAA
_free.LIBCMT ref: 0041EDBC
_free.LIBCMT ref: 0041EDCE

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e1b2229c170471cad9511440fdbaceac99caba8a87cda5d123aefe47b03668a4
Instruction ID: 4fbf26fd28a8761b677517a124a66282875c94d9b9982584bfc58ae744149868
Opcode Fuzzy Hash: e1b2229c170471cad9511440fdbaceac99caba8a87cda5d123aefe47b03668a4
Instruction Fuzzy Hash: 5FF06232504312EB9E20EF6AF885DDB73E9BA44714355085BF808E7640C778FCC0865C

Uniqueness

Uniqueness Score: -1.00%

Function 004152B2 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004152D0

Part of subcall function 0041629A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 004152E2
_free.LIBCMT ref: 004152F5
_free.LIBCMT ref: 00415306
_free.LIBCMT ref: 00415317

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction ID: bd3368c0b25b78dbdc1e8abc7373622524bfd2772586a7011706bfb0bee2724c
Opcode Fuzzy Hash: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction Fuzzy Hash: F3F030B14813208B8A167F16FC415C93B61BB5871931131AFF44956775CB395CA18F8E

Uniqueness

Uniqueness Score: -1.00%

Function 049B5519 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 049B5537

Part of subcall function 049B6501: HeapFree.KERNEL32(00000000,00000000,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?), ref: 049B6517
Part of subcall function 049B6501: GetLastError.KERNEL32(?,?,049BF288,?,00000000,?,00000000,?,049BF52C,?,00000007,?,?,049BF920,?,?), ref: 049B6529

_free.LIBCMT ref: 049B5549
_free.LIBCMT ref: 049B555C
_free.LIBCMT ref: 049B556D
_free.LIBCMT ref: 049B557E

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction ID: 606eef7cf8b57936e5128846f4761caf8670e2861759a608f64fde2503ad2c4c
Opcode Fuzzy Hash: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction Fuzzy Hash: A8F09AB08542209BCA226F18FD804853B62AB15A25312713EF08442278CFB66EB1CFCF

Uniqueness

Uniqueness Score: -1.00%

Function 0041608E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 0041618D

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2895899722
Opcode ID: b52d94582baa6868900cfecb171c62a8035a88aed09a9162bfb2cfc354896c9a
Instruction ID: c5d623140409e6a8d976750a690e768927eb9a43711eccc58faa8c11c80da68b
Opcode Fuzzy Hash: b52d94582baa6868900cfecb171c62a8035a88aed09a9162bfb2cfc354896c9a
Instruction Fuzzy Hash: C851E1B1D40209ABDB10AFA9C845EEF7BB8AF45314F16015BE804B7292D77CD981CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004132C3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe,00000104), ref: 00413303
_free.LIBCMT ref: 004133CE
_free.LIBCMT ref: 004133D8

Strings

C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, xrefs: 004132FA, 00413301, 00413330, 00413368

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
API String ID: 2506810119-2953877501
Opcode ID: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction ID: 1d3d6450662fa2269543f68f0355dd37071cdd96c53fcda0561707c64ab2d40b
Opcode Fuzzy Hash: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction Fuzzy Hash: 4731B371A40218AFCB21DF9A9C819DEBBB8EB84311B1040ABFC14D7210DB788B81CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 049B352A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe,00000104), ref: 049B356A
_free.LIBCMT ref: 049B3635
_free.LIBCMT ref: 049B363F

Strings

C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe, xrefs: 049B3561, 049B3568, 049B3597, 049B35CF

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Pictures\JPl4ZLOvy3fY5RSXGk5s9Gl5.exe
API String ID: 2506810119-2953877501
Opcode ID: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction ID: 45acfbbbfceb61b9751543aaefeb8a39c76a8cfd3f3a94a14860622b08c7fe83
Opcode Fuzzy Hash: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction Fuzzy Hash: A431B571A40258EFDB31DF999E859DEBBFCEB84710F104076E88497210D7B0AA41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 049A374A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A374F

Strings

one, xrefs: 049A3758
qvB, xrefs: 049A374A
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 049A3757

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one$qvB
API String ID: 3519838083-855906859
Opcode ID: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction ID: 680648dfbd11243c3f74c3e3e10bc0b26f9a645513d8047720a9b9d0a057771a
Opcode Fuzzy Hash: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction Fuzzy Hash: 4211C4B2A01515BBEB149F98CC44BAEB7B9FF85724F40453AF818D7240D370AA618BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0040356F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403574

Strings

/ping.php?substr=%s, xrefs: 0040357C
Installed, xrefs: 0040357D
185.172.128.228, xrefs: 0040357B

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed
API String ID: 3519838083-3380671521
Opcode ID: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction ID: e528e6f54f7bd6397a7a31987af09de96e2bb5ca05102ccdf4d55b1b8520bb33
Opcode Fuzzy Hash: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction Fuzzy Hash: 2301C472A01114BBDB04AF899C41BAEF76DEF85315F10013FF405E3292D3789E5186E9

Uniqueness

Uniqueness Score: -1.00%

Function 049C634E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 049C6398
WriteFile.KERNEL32(00000000,?,00000400,049C59A8,00000000), ref: 049C63B0
CloseHandle.KERNEL32(00000000), ref: 049C63B9

Strings

/syncUpd.exe, xrefs: 049C6353

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: /syncUpd.exe
API String ID: 1065093856-1956333723
Opcode ID: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction ID: e7a4722953d4abea6065c55677e6e8b7cd47734b5de6b9825911ee61abf5947a
Opcode Fuzzy Hash: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction Fuzzy Hash: 33F0A4B2301221B7E7345AA99C88E5FBA9DEF846A4F00003DF706D6191DAB1FC0583E5

Uniqueness

Uniqueness Score: -1.00%

Function 049C6438 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,serversystemNCQ_x64.exe), ref: 049C646E
WriteFile.KERNEL32(00000000,?,00000400,049C5DE6,00000000), ref: 049C6486
CloseHandle.KERNEL32(00000000), ref: 049C648F

Strings

serversystemNCQ_x64.exe, xrefs: 049C643C, 049C645D

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: serversystemNCQ_x64.exe
API String ID: 1065093856-4105491473
Opcode ID: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction ID: 952ba8f644425aa387af7ed5cc763b834c49cc7149f4f92a30b9a50905749259
Opcode Fuzzy Hash: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction Fuzzy Hash: 1DF06DB2701221BBE7304BAA9C48E5BBA9DEB856A4F004039B709D6150DAB1FC05D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 049C63C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(?), ref: 049C6408
WaitForSingleObject.KERNEL32(?,00008000), ref: 049C641C
CloseHandle.KERNEL32(?), ref: 049C6425

Strings

/BroomSetup.exe, xrefs: 049C63D1

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: /BroomSetup.exe
API String ID: 3837156514-1897133622
Opcode ID: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction ID: 1808ea22e8731bc7e271204fa7f9ebe47a522d4b425d2ed0f41d2dd985af7f2f
Opcode Fuzzy Hash: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction Fuzzy Hash: 74017C31D00218EBDB15DF69E8445DCBBB8FF48710F40812AF801A6260EB709A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00417D6F Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00417DFA
__alldvrm.LIBCMT ref: 00417FFB
__alldvrm.LIBCMT ref: 0041801D

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction ID: 904abf3455293af5dc28361a3842bc8dfa3977a77267bab69feed652e5be58e7
Opcode Fuzzy Hash: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction Fuzzy Hash: 17A11272A083869FDB218E18C881BEBBBF1EF55354F1441AEE5859B281D63C8982C758

Uniqueness

Uniqueness Score: -1.00%

Function 049B7FD6 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 049B8061
__alldvrm.LIBCMT ref: 049B8262
__alldvrm.LIBCMT ref: 049B8284

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction ID: 5012802e82d8b5467fd7801dbbd2721fa5271b17b0e16c2bcf7be8c32d3ee3c2
Opcode Fuzzy Hash: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction Fuzzy Hash: 28A15531A00A869FEB25EE18C990BEABBEDEF59390F18457DD9D49B240D234A941C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0042286F Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042299E

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c3162c8456312e82e41fd9f8206d1c8395647c3febd80e25e1b83a4a10e5e726
Instruction ID: 73bae74a26b7ada03dc8fd491e978b67bd9d17df28ded5f6e3a1200ab970dd08
Opcode Fuzzy Hash: c3162c8456312e82e41fd9f8206d1c8395647c3febd80e25e1b83a4a10e5e726
Instruction Fuzzy Hash: 2F411BB1B002207BDB206B7A9D41BEE36A4FF05374F54021BF818D6291DAFC89C19669

Uniqueness

Uniqueness Score: -1.00%

Function 049C2AD6 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 049C2C05

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3b94825b8aa3832d3ef3165fe941ff5e47c4270fc62a832450709df6769c8b69
Instruction ID: dc3cdb8e9386d4346fffa520ddd2107a1a5533c92ab60e20513876c2e45725bc
Opcode Fuzzy Hash: 3b94825b8aa3832d3ef3165fe941ff5e47c4270fc62a832450709df6769c8b69
Instruction Fuzzy Hash: 47412B71E002056FEB216FB88D84AEE3669EF83374F1446FDF458D6190DA74B54192A3

Uniqueness

Uniqueness Score: -1.00%

Function 049BB567 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,0042D740,00000000,00000000,8B56FF8B,049B4002,?,00000004,00000001,0042D740,0000007F,?,8B56FF8B,00000001), ref: 049BB5B4
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 049BB63D
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 049BB64F
__freea.LIBCMT ref: 049BB658

Part of subcall function 049B7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 049B7CDE

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 85e830a01370505c20d0c66bcccfbbe4c72d0f29140b44b833c745a57283bd6b
Instruction ID: 5914be6c849e05ff3a5e4b7278fdec1092c93015a1c850368598b7aa2499ada7
Opcode Fuzzy Hash: 85e830a01370505c20d0c66bcccfbbe4c72d0f29140b44b833c745a57283bd6b
Instruction Fuzzy Hash: 8631AE72A0021AABDF258F64CC44DEE7BA9EB40724F054179ED48D6690EB35ED64CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCA4 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0040CCBE

Part of subcall function 0040CC0B: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0040CC3A
Part of subcall function 0040CC0B: ___AdjustPointer.LIBCMT ref: 0040CC55

_UnwindNestedFrames.LIBCMT ref: 0040CCD3
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0040CCE4
CallCatchBlock.LIBVCRUNTIME ref: 0040CD0C

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: 6cd8a4fdf9e309ef40a66346d060796d29459ceaa081db5c793327cde4683266
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: AA012D72500108BBDF116F96CC81DEB3F69EF98758F044129FE0866261C73AE861DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 049ACF0B Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 049ACF25

Part of subcall function 049ACE72: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 049ACEA1
Part of subcall function 049ACE72: ___AdjustPointer.LIBCMT ref: 049ACEBC

_UnwindNestedFrames.LIBCMT ref: 049ACF3A
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 049ACF4B
CallCatchBlock.LIBVCRUNTIME ref: 049ACF73

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: a89fdeff8b5fb8d94bf75f264fb3eeac17ff371374d48ec4eefa8303ea726f4a
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: 5901D772500209BBDF126E95CC44DEB7B6AEF89758F054124FE08AA120D636E871DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 049B74BA Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,049AED94,00000000,00000000,?,049B7461,049AED94,00000000,00000000,00000000,?,049B7719,00000006,0042E2F8), ref: 049B74EC
GetLastError.KERNEL32(?,049B7461,049AED94,00000000,00000000,00000000,?,049B7719,00000006,0042E2F8,0042E2F0,0042E2F8,00000000,00000364,?,049B7052), ref: 049B74F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,049B7461,049AED94,00000000,00000000,00000000,?,049B7719,00000006,0042E2F8,0042E2F0,0042E2F8,00000000), ref: 049B7506

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction ID: 5037308e76c3adc7c9a36415bf093938c5579663efb650b3ea79ce4ac920b083
Opcode Fuzzy Hash: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction Fuzzy Hash: FF014C323426265BC7304FA89D049D7375DAF847A17518B74FA47D3140DB60E905C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004129CD

Strings

pow, xrefs: 004129A5, 004129C2

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ba6df8563b8339eb0810a3e9ef2dc3b9b5ce058691c0daabc23001b6b9fc0b5a
Instruction ID: e871ad958d0c3237763a2db945e0d8ca842ad08ee161d37671be5f50051c649b
Opcode Fuzzy Hash: ba6df8563b8339eb0810a3e9ef2dc3b9b5ce058691c0daabc23001b6b9fc0b5a
Instruction Fuzzy Hash: 5C515BB1B5420296C7257719DF813EB2B90EF40750F60496BE085C63E9EB7C8CE6DA4E

Uniqueness

Uniqueness Score: -1.00%

Function 049C649C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049C64A1

Part of subcall function 049A4073: __EH_prolog.LIBCMT ref: 049A4078
Part of subcall function 049A4073: std::locale::_Init.LIBCPMT ref: 049A409A

_Deallocate.LIBCONCRT ref: 049C65F5

Strings

LyB, xrefs: 049C649C

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog$DeallocateInitstd::locale::_
String ID: LyB
API String ID: 2389838984-3773714357
Opcode ID: b43d6b7ceb65bfdddc8a4d1d72d1a4e11e7704bb8849fddb18eadf6b27138a00
Instruction ID: 25d8a88f25bb04904b5f3f2374f863fc17adf4bbeb287dd6ed9fa5174f595b36
Opcode Fuzzy Hash: b43d6b7ceb65bfdddc8a4d1d72d1a4e11e7704bb8849fddb18eadf6b27138a00
Instruction Fuzzy Hash: C751C0B1A00248DFEB14DFA9C9949EDFBB4FF98304F64422EE445A7241D770AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0041DDFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0041DE21

Strings

, xrefs: 0041DE66
.A, xrefs: 0041DE13

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Info
String ID: $.A
API String ID: 1807457897-2696116503
Opcode ID: 02f55ba3ac5568e03e9fdbd7b88b41772807cc386f704f7c8a9efdfd3a48f4bf
Instruction ID: c8879a2e2c6f1093175ecb34d3b29c7df1a6cb98fe180daaeb3bdf81d7a36b90
Opcode Fuzzy Hash: 02f55ba3ac5568e03e9fdbd7b88b41772807cc386f704f7c8a9efdfd3a48f4bf
Instruction Fuzzy Hash: 56410AF190434C9ADB218E248D84BFABBB9DF55304F1404EEE58A97142D23DAA86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 049ACA17 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 049ACA4A
__IsNonwritableInCurrentImage.LIBCMT ref: 049ACB03

Strings

csm, xrefs: 049ACAED

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction ID: 7bff7e3ac28d6ea88a6fd0e806106cf7733225f1d3ecfedafcd023006ad91e76
Opcode Fuzzy Hash: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction Fuzzy Hash: 28418330E002189BDF10DF68C884AAEBBB9EF85318F148176E915AF391D775B965CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 0041FE6D

Strings

OCP, xrefs: 0041FDE6
ACP, xrefs: 0041FDB0

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction ID: 649476e1b3bbd5175eaef6faf82ab2916ec2ed690aaaaf30446e18060a09e767
Opcode Fuzzy Hash: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction Fuzzy Hash: 6D21F772B04201A6DB308E55D901BE772A69B60B24F568077E90AC7312FB3ADDCA835C

Uniqueness

Uniqueness Score: -1.00%

Function 049BFFF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 049C00D4

Strings

OCP, xrefs: 049C004D
ACP, xrefs: 049C0017

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction ID: 4724996ed4178b17a97102420905b37728143271358395ae8347908e8bd991de
Opcode Fuzzy Hash: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction Fuzzy Hash: 35216262B00104E6EB34CFD48901BAB72AEAB94B59F47847DE949D7100F736F940C366

Uniqueness

Uniqueness Score: -1.00%

Function 049C60F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049C60FE

Part of subcall function 049A1E19: __EH_prolog.LIBCMT ref: 049A1E1E

Part of subcall function 049A266A: __EH_prolog.LIBCMT ref: 049A266F

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 049C61E0

Strings

xB, xrefs: 049C60F9

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID: xB
API String ID: 420165198-2600814558
Opcode ID: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction ID: e40220dc1e4c819e90e785fb5081af0fe1bba20d46339914c15aa9d4614ee7de
Opcode Fuzzy Hash: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction Fuzzy Hash: 6F31D874D01119EBEB14EF94D995AEDF7B4FF88204F1085AAE405A3640EB746E18CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 049A33DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A33E1
std::locale::_Init.LIBCPMT ref: 049A3428

Part of subcall function 049A7FDA: __EH_prolog3.LIBCMT ref: 049A7FE1
Part of subcall function 049A7FDA: std::_Lockit::_Lockit.LIBCPMT ref: 049A7FEC
Part of subcall function 049A7FDA: std::locale::_Setgloballocale.LIBCPMT ref: 049A8007
Part of subcall function 049A7FDA: _Yarn.LIBCPMT ref: 049A801D
Part of subcall function 049A7FDA: std::_Lockit::~_Lockit.LIBCPMT ref: 049A805D

Part of subcall function 049A3651: __EH_prolog.LIBCMT ref: 049A3656
Part of subcall function 049A3651: std::_Lockit::_Lockit.LIBCPMT ref: 049A3665
Part of subcall function 049A3651: int.LIBCPMT ref: 049A367C
Part of subcall function 049A3651: std::locale::_Getfacet.LIBCPMT ref: 049A3685
Part of subcall function 049A3651: std::_Lockit::~_Lockit.LIBCPMT ref: 049A36CC

Part of subcall function 049A1AE6: __CxxThrowException@8.LIBVCRUNTIME ref: 049A1B30
Part of subcall function 049A1AE6: std::system_error::system_error.LIBCPMT ref: 049A1B3F

Strings

!vB, xrefs: 049A33DC

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$std::locale::_$H_prologLockit::_Lockit::~_$Exception@8GetfacetH_prolog3InitSetgloballocaleThrowYarnstd::system_error::system_error
String ID: !vB
API String ID: 372095707-662244105
Opcode ID: 4deb0b62ca6bed2fa6a44367b456c2ab057c0f4f5e284071d2ebbd93a586d0bc
Instruction ID: c943869045353e9d8ad5f6a148835c6b9e8f4ea8fc03c810628197f07dd38dd1
Opcode Fuzzy Hash: 4deb0b62ca6bed2fa6a44367b456c2ab057c0f4f5e284071d2ebbd93a586d0bc
Instruction Fuzzy Hash: 9F2126B1A00A06AFD714DF6AC185659FBF4FB48314F50822ED01997A80D774F964CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 004171B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00417217
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00417224

Strings

-@, xrefs: 004171EE, 00417202, 004171F3

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: -@
API String ID: 2279764990-2564449678
Opcode ID: dc50904c779d9d650c94e7699dac49ecaf35141d5acdb291f08ec5f954601914
Instruction ID: be5354ef9640d5baeda707f88ba0ee7c606e7dd11eb492dad25bcfdc379f5c6d
Opcode Fuzzy Hash: dc50904c779d9d650c94e7699dac49ecaf35141d5acdb291f08ec5f954601914
Instruction Fuzzy Hash: E7110633A04120ABAB369E19EC809DB73B9AB843207164272FD15AB344DB34DCC2C6D9

Uniqueness

Uniqueness Score: -1.00%

Function 004034E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004034E8

Strings

/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 004034F0
one, xrefs: 004034F1

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one
API String ID: 3519838083-2876206925
Opcode ID: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction ID: 23fc970319ec432bccea8ea3542248735fa0f2929cdefa52ec0488ef77b85577
Opcode Fuzzy Hash: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction Fuzzy Hash: BD11C232A00014BBDB04AF899C01BAEBB69EF45315F40012FF405A3292D3799A518BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402FE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402FEA
std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00407D73: __EH_prolog3.LIBCMT ref: 00407D7A
Part of subcall function 00407D73: std::_Lockit::_Lockit.LIBCPMT ref: 00407D85
Part of subcall function 00407D73: std::locale::_Setgloballocale.LIBCPMT ref: 00407DA0
Part of subcall function 00407D73: _Yarn.LIBCPMT ref: 00407DB6
Part of subcall function 00407D73: std::_Lockit::~_Lockit.LIBCPMT ref: 00407DF6

Strings

T*@, xrefs: 00402FFA

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prologH_prolog3InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: T*@
API String ID: 4198646248-2370032326
Opcode ID: 7dfcf93c417fa76e04d3e3a4fed8d4ff5bf7dd665a8af5c4b3da1b51d53f7e53
Instruction ID: c469f1781f4eb74895915257e237cd09ecdba2ecacf51dc6ab7e16c1717fddcf
Opcode Fuzzy Hash: 7dfcf93c417fa76e04d3e3a4fed8d4ff5bf7dd665a8af5c4b3da1b51d53f7e53
Instruction Fuzzy Hash: F921B0B5A00A06AFC305DF6AD581995FBF8FF49314B40822FE80987B50E774A964CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040436E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404373

Part of subcall function 00403A42: __EH_prolog.LIBCMT ref: 00403A47

__Getcoll.LIBCPMT ref: 004043CF

Strings

u@@, xrefs: 004043C9

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: H_prolog$Getcoll
String ID: u@@
API String ID: 206117190-736001340
Opcode ID: da0bdbbc3b0f42b801ac3b2eb85bb2a3e1abbe298574f711ddba54968d2ab91f
Instruction ID: 22f8a194e856adbcf5db44b98b1892bbe0116132472f20e5c64479f843611134
Opcode Fuzzy Hash: da0bdbbc3b0f42b801ac3b2eb85bb2a3e1abbe298574f711ddba54968d2ab91f
Instruction Fuzzy Hash: 511170B19012099FCB04EFA9C581A9DBBB4FF84308F10843FE545BB281D7789A44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 049A45D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A45DA

Part of subcall function 049A3CA9: __EH_prolog.LIBCMT ref: 049A3CAE

__Getcoll.LIBCPMT ref: 049A4636

Strings

cwB, xrefs: 049A45D5

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog$Getcoll
String ID: cwB
API String ID: 206117190-1299997670
Opcode ID: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction ID: f3c61a9603eaa4f51ab54609f5ea8776657e6ec3be4b6a0084f82424b4833745
Opcode Fuzzy Hash: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction Fuzzy Hash: 511179B2D00209EFDB14EFA8D484A9DBBF4FF84318F10803ED015AB200DB74AA54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 049A1A6D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 049A1A72

Strings

?uB, xrefs: 049A1A6D
ios_base::failbit set, xrefs: 049A1A82

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: ?uB$ios_base::failbit set
API String ID: 3519838083-946796157
Opcode ID: 234de090022dfe67052ebfa9b3a4f165bdb172cecaf10e59d262a8163687a49b
Instruction ID: f86c42352bd8cc71bfbbf74e4ac200872bf5410c25cbdb7c723c61346d4157fb
Opcode Fuzzy Hash: 234de090022dfe67052ebfa9b3a4f165bdb172cecaf10e59d262a8163687a49b
Instruction Fuzzy Hash: 3E0171725101099FDB04EF98C444BFDFBB8EF89318F14816EE401A7250D7B46A45CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6D4 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 0041A76A
GetLastError.KERNEL32 ref: 0041A778
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0041A7D3

Memory Dump Source

Source File: 00000008.00000002.3315694164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 796b5502bf3758a62d3774a2a03d829f786e940855c074945e7165fbf0666ef5
Instruction ID: 87839b596d2bb0c5de59c8c1227ac8d795198cb32e80a538f680ccd386729a76
Opcode Fuzzy Hash: 796b5502bf3758a62d3774a2a03d829f786e940855c074945e7165fbf0666ef5
Instruction Fuzzy Hash: 04410830602246AFCF219F69C944AEF7BB4AF01310F15416AEC6997291DB38CDA2C75A

Uniqueness

Uniqueness Score: -1.00%

Function 049BA93B Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 049BA9D1
GetLastError.KERNEL32 ref: 049BA9DF
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 049BAA3A

Memory Dump Source

Source File: 00000008.00000002.3337248481.00000000049A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_49a0000_JPl4ZLOvy3fY5RSXGk5s9Gl5.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e2dcd7916019b3a733183e7ba2e3bccfca86bceaf396c0a8a97430b0cc35b528
Instruction ID: 9fffa22c0f4a94a8ad6160003ca8702d17ffab3c2cf5220de227be76cb1baad9
Opcode Fuzzy Hash: e2dcd7916019b3a733183e7ba2e3bccfca86bceaf396c0a8a97430b0cc35b528
Instruction Fuzzy Hash: 8441E830600206AFDF218F65CB48AEE7BAADF41310F158579F9D9971A0DB30A901D7F4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: JIsbjewlnghreiCB15kllzTk.exePID: 7992, Parent PID: 7520COMMON

Non-executed Functions

Function 00433840 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

bad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegcentersyscallexit status failed t, xrefs: 00433A4A
CreateWaitableTimerEx when creating timer failedHKCU\Software\Classes\mscfile\shell\open\commandMozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)SELECT OSArchitecture FROM Win32_OperatingSystem"%s" --nt-service -f "%s" --Log "notice file %s"bufio: writer return, xrefs: 00433B00
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 00433A71
,/=MOScghs ( + , / @ P [ %q%v(") )()*., ->-r-t.\///C/d/f/i/q/s/v000X0b0o0s0x25536480: :]; =#> ??A3A4AVB:CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOKOUPCPcPdPePfPiPoPsSBSTScSkSmSoTeToV1V2V3V5V6V7YiZlZpZs")":"\*\D\E\S\W\"\\\d\n\r\s\w ])]:][]dsh2i)idipivmsn=nsos, xrefs: 00433A05
VirtualQuery for stack base failedadding nil Certificate to CertPoolarchive/tar: header field too longchacha20: wrong HChaCha20 key sizecouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu, xrefs: 00433AA5
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state , xrefs: 00433ACC
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not, xrefs: 00433B27
runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftset HTTPS proxy: %wsignature not foundskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected data: %vunexpected g , xrefs: 004339DB
%, xrefs: 00433B64
runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]tls: failed to verify certificate: %st, xrefs: 00433B5B

Memory Dump Source

Source File: 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3312022979.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_JIsbjewlnghreiCB15kllzTk.jbxd

Yara matches

Similarity

API ID:
String ID: %$,/=MOScghs ( + , / @ P [ %q%v(") )()*., ->-r-t.\///C/d/f/i/q/s/v000X0b0o0s0x25536480: :]; =#> ??A3A4AVB:CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOKOUPCPcPdPePfPiPoPsSBSTScSkSmSoTeToV1V2V3V5V6V7YiZlZpZs")":"\*\D\E\S\W\"\\\d\n\r\s\w ])]:][]dsh2i)idipivmsn=nsos$CreateWaitableTimerEx when creating timer failedHKCU\Software\Classes\mscfile\shell\open\commandMozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)SELECT OSArchitecture FROM Win32_OperatingSystem"%s" --nt-service -f "%s" --Log "notice file %s"bufio: writer return$VirtualQuery for stack base failedadding nil Certificate to CertPoolarchive/tar: header field too longchacha20: wrong HChaCha20 key sizecouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu$bad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegcentersyscallexit status failed t$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]tls: failed to verify certificate: %st$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state $runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftset HTTPS proxy: %wsignature not foundskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected data: %vunexpected g
API String ID: 0-2845907608
Opcode ID: 4861b8a6a2a3058dc2e1ec19f5ab3598cb0c009544e4972bfa7db612a91145a9
Instruction ID: 54d86a38c7ca5e9b4d361dfb47ed8c6cf3eb888c171a558932b5f88d5bc68312
Opcode Fuzzy Hash: 4861b8a6a2a3058dc2e1ec19f5ab3598cb0c009544e4972bfa7db612a91145a9
Instruction Fuzzy Hash: 8281CFB45097018FD700EF66C18575AFBE0BF88708F41992EF49887392EB789949CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00443890 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog, xrefs: 00443929
m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...), i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerAr, xrefs: 0044394B
p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC)%s (%d): %s) at entry+, elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req, xrefs: 00443997
releasep: invalid argremoving command appsruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestun.sip, xrefs: 004439E1

Memory Dump Source

Source File: 0000000A.00000002.3312022979.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3312022979.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3312022979.0000000000843000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3312022979.0000000000ACD000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_JIsbjewlnghreiCB15kllzTk.jbxd

Yara matches

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...), i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerAr$ p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC)%s (%d): %s) at entry+, elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req$releasep: invalid argremoving command appsruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestun.sip$releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog
API String ID: 0-3530339137
Opcode ID: 147a754e04b331b36706bf54a1f15f1a33f6f9f3812af3793d82f5f849fb4b27
Instruction ID: 41eda2ad12dc9040aabd0b4fda58d31df6fc94468559f7c6cc3daccb715ab915
Opcode Fuzzy Hash: 147a754e04b331b36706bf54a1f15f1a33f6f9f3812af3793d82f5f849fb4b27
Instruction Fuzzy Hash: 9C31E2B45087418FD700EF25C185B1AFBE1BF88708F45882EF4888B352DB789948CB6A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: T2RIU3FpH6dczIGTG32vuvvE.exePID: 8168, Parent PID: 8100COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1944
Total number of Limit Nodes:	15

Executed Functions

Function 6B92E700 Relevance: 53.0, APIs: 17, Strings: 13, Instructions: 485
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 6B92E7B6
TryAcquireSRWLockExclusive.KERNEL32(3275000C), ref: 6B92E7D4
CreateEventW.KERNEL32 ref: 6B92E821
CreateEventW.KERNEL32 ref: 6B92E841
CreateEventW.KERNEL32 ref: 6B92E85C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6B92E93E
GetCurrentProcess.KERNEL32 ref: 6B92E96A
DuplicateHandle.KERNEL32(00000000,?,?,?,00100002,00000000,00000000), ref: 6B92E983
GetCurrentProcess.KERNEL32 ref: 6B92E9AB
DuplicateHandle.KERNEL32(00000000,?,?,?,00100002,00000000,00000000), ref: 6B92E9C2
GetCurrentProcess.KERNEL32 ref: 6B92E9EA
DuplicateHandle.KERNEL32(00000000,?,?,?,00100002,00000000,00000000), ref: 6B92EA01
__Init_thread_header.LIBCMT ref: 6B92EAE5
__Init_thread_footer.LIBCMT ref: 6B92EB18
ImpersonateNamedPipeClient.ADVAPI32(C72674FF), ref: 6B92EB49
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 6B92EB5D
RevertToSelf.ADVAPI32 ref: 6B92EB69

Strings

expecting: , xrefs: 6B92EC63
failed to open , xrefs: 6B92EBB9
forged shutdown request, got: , xrefs: 6B92ED20
ImpersonateNamedPipeClient, xrefs: 6B92EBFC
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6B92EB35
ServiceClientConnection, xrefs: 6B92ED9D
forged client pid, real pid: , xrefs: 6B92ECAF
unhandled message type: , xrefs: 6B92ED70
::GetNamedPipeClientProcessId, xrefs: 6B92EAFC
, got: , xrefs: 6B92ECC9
kernel32.dll, xrefs: 6B92EB01
unexpected version. got: , xrefs: 6B92EC49
..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc, xrefs: 6B92EBA7, 6B92EBEA, 6B92EC37, 6B92EC9D, 6B92ED0E, 6B92ED5E, 6B92ED98

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Process$CreateCurrentDuplicateEventHandle$ExclusiveLockOpen$AcquireClientImpersonateInit_thread_footerInit_thread_headerNamedPipeReleaseRevertSelf
String ID: expecting: $, got: $..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc$..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$::GetNamedPipeClientProcessId$ImpersonateNamedPipeClient$ServiceClientConnection$failed to open $forged client pid, real pid: $forged shutdown request, got: $kernel32.dll$unexpected version. got: $unhandled message type:
API String ID: 148007397-3007050188
Opcode ID: d7bdd5cc153306b587b5b9e6ba01bfb8e6570ba1087ae0b591d95d82edc1764e
Instruction ID: 7739689b1dc71012605f4fac79daf4562604f2679a73bffa9871847572de6557
Opcode Fuzzy Hash: d7bdd5cc153306b587b5b9e6ba01bfb8e6570ba1087ae0b591d95d82edc1764e
Instruction Fuzzy Hash: B102B270D603049FEF10DF78CC86BA977B8BF59308F0085A9E909A7295EB34D985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6B9D65F0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6B9D6600

Strings

bad_array_new_length was thrown in -fno-exceptions mode, xrefs: 6B9D6743
..\..\third_party\libc++\src\include\__string\char_traits.h:222: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 6B9D66FC
basic_string, xrefs: 6B9D6723, 6B9D6753
out_of_range was thrown in -fno-exceptions mode with message "%s", xrefs: 6B9D6766
length_error was thrown in -fno-exceptions mode with message "%s", xrefs: 6B9D6736
..\..\third_party\libc++\src\include\string:973: assertion __s != nullptr failed: basic_string(const char*) detected nullptr, xrefs: 6B9D666A, 6B9D6703
01, xrefs: 6B9D676B
..\..\third_party\libc++\src\include\__string\char_traits.h:145: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 6B9D6663

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:145: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\__string\char_traits.h:222: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:973: assertion __s != nullptr failed: basic_string(const char*) detected nullptr$bad_array_new_length was thrown in -fno-exceptions mode$basic_string$length_error was thrown in -fno-exceptions mode with message "%s"$out_of_range was thrown in -fno-exceptions mode with message "%s"$01
API String ID: 4218353326-118191342
Opcode ID: 044bc93eaa2efa7fdb0a850c24911e6bf90834b2557b11c4e6733c8d073f8096
Instruction ID: 0f87e95717cb517a2f35b8cd591e33dc53d0db7cbdfa094d6a295ef829b3239b
Opcode Fuzzy Hash: 044bc93eaa2efa7fdb0a850c24911e6bf90834b2557b11c4e6733c8d073f8096
Instruction Fuzzy Hash: 13510571A007096FDB105EBADC95A5B7BADEB5265CF50843AE614C7200EB79E840C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6B86EEF0 Relevance: 15.1, APIs: 10, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 6B86EF26
GetCurrentThread.KERNEL32 ref: 6B86EF2A
GetCurrentProcess.KERNEL32 ref: 6B86EF32
DuplicateHandle.KERNELBASE(00000000,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6B86EF44
GetLastError.KERNEL32 ref: 6B86EF5C
SetLastError.KERNEL32(00000000), ref: 6B86EF73
GetCurrentThreadId.KERNEL32 ref: 6B86EF80
GetCurrentThreadId.KERNEL32 ref: 6B86EFDD
GetCurrentThread.KERNEL32 ref: 6B86EFEC
GetThreadPriority.KERNEL32(00000000), ref: 6B86EFF3

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Current$Thread$ErrorLastProcess$DuplicateHandlePriority
String ID:
API String ID: 1544239892-0
Opcode ID: a512a026b87f690b215fb5f4902209fe5082dde2dd4c70349ea2618ac2b85c30
Instruction ID: fed126377a8f447606a2a0b19a4d2e66ea1eee52ac56952ac5a7742d04dd51f8
Opcode Fuzzy Hash: a512a026b87f690b215fb5f4902209fe5082dde2dd4c70349ea2618ac2b85c30
Instruction Fuzzy Hash: F7311675E043059BEB00AFB8CC4996F7B69EF85258B004D29E911D3241EB38DC02C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B92E530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 6B92E557
DisconnectNamedPipe.KERNELBASE(?), ref: 6B92E569
ConnectNamedPipe.KERNELBASE(?,00000000), ref: 6B92E570

Strings

ConnectNamedPipe, xrefs: 6B92E5F6
..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc, xrefs: 6B92E5EA

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: NamedPipe$ConnectDisconnectErrorLast
String ID: ..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc$ConnectNamedPipe
API String ID: 30367271-692259547
Opcode ID: 2384d4c44c8bae7faf54f37c6b2d79829ef22bf1a99e2ab631a32b54274d953b
Instruction ID: 912d4e59e2998a7c02fd3a11913a198209b373a381e98d4e38261469059a321a
Opcode Fuzzy Hash: 2384d4c44c8bae7faf54f37c6b2d79829ef22bf1a99e2ab631a32b54274d953b
Instruction Fuzzy Hash: 0B2138B0D30704ABEF10DB34DC86FAA776C6F5271CF004464D91493299EB7DE555C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C36AB Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,6B9B53FD,6B9C25A0,?,00000000,?,6B9A540E,00000000,?,?,?,?,?,?,6B9EAED7), ref: 6B9C36AF
SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6B9C3751

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6c860a95b73328759c44ecd25abf3f0815fbebca91697e2cba23bffdd0e17ba1
Instruction ID: 99258e323ce89b718f60426ed93979b0f6429c7b0bf2f44f231e0b9c11519e16
Opcode Fuzzy Hash: 6c860a95b73328759c44ecd25abf3f0815fbebca91697e2cba23bffdd0e17ba1
Instruction Fuzzy Hash: 9611E97121C3106FFB2126789DC6E473B6CAF12BACB100634F124931A1DB3CC9058263

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6B889C20 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 193windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,6B889E89,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6B889C4B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,6B889E89,?,?), ref: 6B889C55
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6B889CB2

Strings

..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6B889DB4
..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6B889DC2
(0x%lX), xrefs: 6B889CC3
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6B889DBB
Error (0x%lX) while retrieving error. (0x%lX), xrefs: 6B889C5D

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: (0x%lX)$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Error (0x%lX) while retrieving error. (0x%lX)
API String ID: 1365068426-2639129309
Opcode ID: 0e3f090218453dacf67281586035a7b71ad050e120b2a4195c27082607167e6d
Instruction ID: 18db37a9e80dd59c004519510673c56da6c4c424ee18d5fc432c98e14ebedcd6
Opcode Fuzzy Hash: 0e3f090218453dacf67281586035a7b71ad050e120b2a4195c27082607167e6d
Instruction Fuzzy Hash: A851E4B1E04204AFEF11DF74CC45AEFBBB9AF55348F04442DE846A7212EB39A945C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C83B7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,6B9C7D6D,?,?), ref: 6B9C8450
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,6B9C7D6D,?,?), ref: 6B9C8479
GetACP.KERNEL32(?,?,6B9C7D6D,?,?), ref: 6B9C848E

Strings

ACP, xrefs: 6B9C83D5
OCP, xrefs: 6B9C840B

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 58ab863218c4c7e168170ddb24c014bbc39f5ad3b6478868525a5b21a8455670
Instruction ID: 6d28155c401e42ad5a12dc21e3f00b84458ac180444ac7bdaa4ab99df4ae7b15
Opcode Fuzzy Hash: 58ab863218c4c7e168170ddb24c014bbc39f5ad3b6478868525a5b21a8455670
Instruction Fuzzy Hash: 8A21C572A04201ABE72CCF14C881BAB77BEEF45F54B9288A4E909DB110E73ADD41C353

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C7C37 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 6B9C355A: GetLastError.KERNEL32(00000000,?,6B9BFC5D), ref: 6B9C355E
Part of subcall function 6B9C355A: SetLastError.KERNEL32(00000000,?,?,00000016,6B9A8A7B), ref: 6B9C3600

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6B9C7D3F
IsValidCodePage.KERNEL32(?), ref: 6B9C7D7D
IsValidLocale.KERNEL32(?,00000001), ref: 6B9C7D90
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 6B9C7DD8
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 6B9C7DF3

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 9a1684c9a616882f8a664f05f7abbf13c1d4328e88537a38eebce0d82f811884
Instruction ID: 1888fc9d23caf66101bc10ad73dcbf01c9cc3c0e444e152da232e394a90b12f0
Opcode Fuzzy Hash: 9a1684c9a616882f8a664f05f7abbf13c1d4328e88537a38eebce0d82f811884
Instruction Fuzzy Hash: D7513F72A00205ABEF10DFA5CC45ABB7BBCBF15704F104469E910EB151DB78D9418B63

Uniqueness

Uniqueness Score: -1.00%

Function 6B9AD960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2fca1aa51c1dee48d6e65cd30f053d14d7f57256149e23afecdc9cc702f876
Instruction ID: de7ec31d98f0e0d7ab9408e83958b8eb1f13cf77c1b8501faf09bc06ca0fe01b
Opcode Fuzzy Hash: 1d2fca1aa51c1dee48d6e65cd30f053d14d7f57256149e23afecdc9cc702f876
Instruction Fuzzy Hash: 6F024B71E412199BDB14CFA9C9807AEFBB5FF48314F2582A9D919E7380D735AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B906BE0 Relevance: 3.0, APIs: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,6B92EB0B,kernel32.dll,::GetNamedPipeClientProcessId,00000000), ref: 6B906BE6
GetProcAddress.KERNEL32(00000000,?), ref: 6B906C10

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: cab294e94e4b3c378224ae7e6de5ade111c752684a49ad2087dc9a4c85bb26f0
Instruction ID: f4da939cd773a16ee0ed64234b516bb78865c485fe0356ed51106c355174f44e
Opcode Fuzzy Hash: cab294e94e4b3c378224ae7e6de5ade111c752684a49ad2087dc9a4c85bb26f0
Instruction Fuzzy Hash: F2E09AA0A482A06AFB010A21C8046263F6EDB47358B58C48EE25A49021DF3BC892C211

Uniqueness

Uniqueness Score: -1.00%

Function 6B889190 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 354
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6B8891B3
GetLocalTime.KERNEL32(?), ref: 6B889298
_strlen.LIBCMT ref: 6B8893A2
GetTickCount.KERNEL32 ref: 6B88952E

Strings

UNKNOWN, xrefs: 6B8894DA
:, xrefs: 6B88956D
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6B8894C4
)] , xrefs: 6B8893F5
..\..\third_party\libc++\src\include\string_view:418: assertion __n <= size() failed: remove_prefix() can't remove more than size(), xrefs: 6B8894B6
VERBOSE, xrefs: 6B88950B
..\..\third_party\libc++\src\include\string_view:326: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range, xrefs: 6B8894CB
..\..\third_party\libc++\src\include\__string\char_traits.h:145: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 6B8894BD

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: _strlen$CountLocalTickTime
String ID: )] $..\..\third_party\libc++\src\include\__string\char_traits.h:145: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:326: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range$..\..\third_party\libc++\src\include\string_view:418: assertion __n <= size() failed: remove_prefix() can't remove more than size()$:$UNKNOWN$VERBOSE
API String ID: 3535325690-3909393061
Opcode ID: 598430d8f230bc35f47024f8e5e66ec1040d16547374bf16824b00183ea344c4
Instruction ID: e8b990a003efc8bd64ae0c13d2c2d06db421d2a0fbaa7dfbc5e4afe13c170f0f
Opcode Fuzzy Hash: 598430d8f230bc35f47024f8e5e66ec1040d16547374bf16824b00183ea344c4
Instruction Fuzzy Hash: BCC1F5B5E00208AFDF14CB74D855AAE77B8EF5A30CF044469E80577292EB79AD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B890D10 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6B890D33
__Init_thread_header.LIBCMT ref: 6B890DFF
__Init_thread_footer.LIBCMT ref: 6B890E30
__Init_thread_header.LIBCMT ref: 6B890E42
__Init_thread_footer.LIBCMT ref: 6B890E70

Strings

FeatureList-feature-accessed-too-early, xrefs: 6B890E19
true, xrefs: 6B890D79
false, xrefs: 6B890D7E, 6B890DB3
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6B890DEB
FeatureList-early-access-allow-list, xrefs: 6B890E59

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Init_thread_footerInit_thread_header$_strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$FeatureList-early-access-allow-list$FeatureList-feature-accessed-too-early$false$true
API String ID: 3247314413-900038432
Opcode ID: 964bb2392bdff0272d43806a266d14d82a2945260db9e6b4adcf0ff3d15d492f
Instruction ID: 1626a5032bdfdd069ff743821123556350e35088654a640bf854d6c7d05476ee
Opcode Fuzzy Hash: 964bb2392bdff0272d43806a266d14d82a2945260db9e6b4adcf0ff3d15d492f
Instruction Fuzzy Hash: 9E3105B1D442049FDF20EF78DC46EAE77B0FB56718F004569D4115B281E739E886CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 6B92EDD0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,?,?,?,000000FF,00000000), ref: 6B92EDF9
RegisterWaitForSingleObject.KERNEL32(?,?,?,?,000000FF,00000000), ref: 6B92EE13
RegisterWaitForSingleObject.KERNEL32(?,?,?,?,000000FF,00000008), ref: 6B92EE2A

Strings

RegisterWaitForSingleObject crash dump requested, xrefs: 6B92EE7E
RegisterWaitForSingleObject process end, xrefs: 6B92EF18
..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc, xrefs: 6B92EE6C, 6B92EEB9, 6B92EF06
RegisterWaitForSingleObject non-crash dump requested, xrefs: 6B92EECB

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ObjectRegisterSingleWait
String ID: ..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc$RegisterWaitForSingleObject crash dump requested$RegisterWaitForSingleObject non-crash dump requested$RegisterWaitForSingleObject process end
API String ID: 1092942010-2013388152
Opcode ID: ebc114c9917e8f435fb1e7f27b30e13eb73c74f441b426106fce882eecbaee6e
Instruction ID: a58d2bbe10474af6ae29349a814ac32c2901df6eb6e3574e91eb966004ddd360
Opcode Fuzzy Hash: ebc114c9917e8f435fb1e7f27b30e13eb73c74f441b426106fce882eecbaee6e
Instruction Fuzzy Hash: BF313A71A503147BEE209A749C4BFAE3B7DAF41718F404438F625672C6DB38EA08C672

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C5801 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6B9C5887

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 20edee776f376f9c7d81a41635e786f58393c476568771fd663273798316f5b8
Instruction ID: 829df29353bd54407933fe4de52080c93ac25cdf391c6edbedb4c1807a08fbec
Opcode Fuzzy Hash: 20edee776f376f9c7d81a41635e786f58393c476568771fd663273798316f5b8
Instruction Fuzzy Hash: 34B13A72D043559FDB018F64CC82BAF7BB9EF5A314F154196E608AB282D778D901C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6B9D9E40 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6B9D9F62
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B9D9FB7

Strings

%*s:%s, xrefs: 6B9D9F8F
[%03u.%03u] , xrefs: 6B9D9FFB
%s%s %s, xrefs: 6B9DA01D
[printf format error], xrefs: 6B9D9EE1

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: %*s:%s$%s%s %s$[%03u.%03u] $[printf format error]
API String ID: 2172594012-3351823563
Opcode ID: 872e0fe2aacfec7f5c04cb6736c17c1042c44d667f82e87f0f76a7be618479ab
Instruction ID: 9836c5bff280d23d19b67a8677bd343663ea855ed37e47a536a85f1374ec1231
Opcode Fuzzy Hash: 872e0fe2aacfec7f5c04cb6736c17c1042c44d667f82e87f0f76a7be618479ab
Instruction Fuzzy Hash: A65169B2D047416BEB00AF34CC46E6BBB69EFD6318F00CA2DF95952181EB39D55487A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B9A5690 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6B9A56C7
___except_validate_context_record.LIBVCRUNTIME ref: 6B9A56CF
_ValidateLocalCookies.LIBCMT ref: 6B9A5758
__IsNonwritableInCurrentImage.LIBCMT ref: 6B9A5783
_ValidateLocalCookies.LIBCMT ref: 6B9A57D8

Strings

csm, xrefs: 6B9A576D

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ea0ee7c894f819553575e0201ff4820166721714c4bc12cc405b4e529ff7d493
Instruction ID: 8b2c0f50d0de5712cf927de2641e376f47cf5fa14254ea3810695cc7f8046a12
Opcode Fuzzy Hash: ea0ee7c894f819553575e0201ff4820166721714c4bc12cc405b4e529ff7d493
Instruction Fuzzy Hash: 63519834B04218DFCF00DF78C884A9E7BB5EF45318F158195D924AB361DB39EA42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B8D9720 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 151COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000), ref: 6B8D9736

Part of subcall function 6B9664C0: AcquireSRWLockExclusive.KERNEL32(6BAC0FDC,?,6B890BC2,?,6B890B85,00000003,00000000,?,6B894305,6BABBA84), ref: 6B9664C4

ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6B8D9882

Strings

id_to_handle_iter != thread_id_to_handle_.end(), xrefs: 6B8D9837
handle_to_name_iter != thread_handle_to_interned_name_.end(), xrefs: 6B8D9797
RemoveName, xrefs: 6B8D977E, 6B8D981E
..\..\base\threading\thread_id_name_manager.cc, xrefs: 6B8D9779, 6B8D9819

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: ..\..\base\threading\thread_id_name_manager.cc$RemoveName$handle_to_name_iter != thread_handle_to_interned_name_.end()$id_to_handle_iter != thread_id_to_handle_.end()
API String ID: 1678258262-1713423127
Opcode ID: a78653f2442565244bc2c4e419a52eb977514094ae95d0c37f526d26ce24957b
Instruction ID: 426bcb79e2004c9e08d1a8291bf1d1b161793a9ecf526b1f0ec96435ae5e0c23
Opcode Fuzzy Hash: a78653f2442565244bc2c4e419a52eb977514094ae95d0c37f526d26ce24957b
Instruction Fuzzy Hash: C951F631F04205DFDF18DE39D86096A73F5BF94B09740496EE41A97241EB39E905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B86EDA0 Relevance: 10.6, APIs: 7, Instructions: 99threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 6B86EDC5
SetThreadPriority.KERNEL32(00000000,7FFFFFFF,?,6B86F040,?,?), ref: 6B86EDF3
GetCurrentThread.KERNEL32 ref: 6B86EE36
SetThreadInformation.KERNEL32(00000000,00000003,?,0000000C,?,6B86F040,?,?), ref: 6B86EE42
SetThreadPriority.KERNEL32(00000000,00020000,?,6B86F040,?,?), ref: 6B86EE7D
SetThreadPriority.KERNEL32(00000000,000000FE,?,6B86F040,?,?), ref: 6B86EEC3
SetThreadInformation.KERNEL32(00000000,00000000,?,00000004,?,6B86F040,?,?), ref: 6B86EEDD

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Thread$Priority$CurrentInformation
String ID:
API String ID: 3180331770-0
Opcode ID: ef8941ad267e5d34845b324ad84c22454d27bf1c1a7f2147a739307fe9386bdd
Instruction ID: 6c8e9202cc4033cd49cd52fbe2e166c50efd3f979505b82aa53ea4196d7ceb32
Opcode Fuzzy Hash: ef8941ad267e5d34845b324ad84c22454d27bf1c1a7f2147a739307fe9386bdd
Instruction Fuzzy Hash: 023138B1A5C3189FEB114FB88C487AA3B64EB0B7D2F004D65E97947291E77DC846C750

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C413E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 6B9C41FF

Strings

api-ms-, xrefs: 6B9C4195
ext-ms-, xrefs: 6B9C41A9

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5273ab4dc64e68eceadc9fe06c7ca4a90c718756be0d0f46c7ea2a9c6bde66f9
Instruction ID: c44684e22e0be3727b78709ca87eeaa5bc78962714d14f2bf3ea43eaa814aa13
Opcode Fuzzy Hash: 5273ab4dc64e68eceadc9fe06c7ca4a90c718756be0d0f46c7ea2a9c6bde66f9
Instruction Fuzzy Hash: 3D210B35B453209BEB129F65CC46A8B37ACDB637A4B109151EC66A7390D738E901CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C16F1 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000001,6B9C16E8,6B9A57F4,00000011), ref: 6B9C16FF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6B9C170D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6B9C1726
SetLastError.KERNEL32(00000000), ref: 6B9C1778

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 752ec97fd4d2c0741cc71461a60c527e48b1c43d748845b29e6909b443629244
Instruction ID: 6299accb5766f3abb9b92381d09e131d32be29b99ba81daeb5d285e6f254acfe
Opcode Fuzzy Hash: 752ec97fd4d2c0741cc71461a60c527e48b1c43d748845b29e6909b443629244
Instruction Fuzzy Hash: 4D01FC3260C7319EFB051679AC965572F68DB13A7D730C63DE230860F0EF59C806A197

Uniqueness

Uniqueness Score: -1.00%

Function 6B890E80 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6B890E91

Strings

..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6B890EEC
false, xrefs: 6B890E85, 6B890F13
..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6B890EE5
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6B890EF3

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$false
API String ID: 4218353326-3383702859
Opcode ID: cde5d95220bedd588a27d67448b62b716d77991d330e9d3ec6c6a8eeb98c3c77
Instruction ID: b5c7effcc0ebf5711635ed6333594b422ab091d36380784b71ff27ddc9787f03
Opcode Fuzzy Hash: cde5d95220bedd588a27d67448b62b716d77991d330e9d3ec6c6a8eeb98c3c77
Instruction Fuzzy Hash: BB1125737443596FAF00AE6C6C40A5E77ACAE59A58B040875FE58C7300EB3AE84083E2

Uniqueness

Uniqueness Score: -1.00%

Function 6B9B273E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E0FB1D68,?,?,00000000,6BA323AF,000000FF,?,6B9B27FF,00000002,?,6B9B289B,6B9B8161), ref: 6B9B2773
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6B9B2785
FreeLibrary.KERNEL32(00000000,?,?,00000000,6BA323AF,000000FF,?,6B9B27FF,00000002,?,6B9B289B,6B9B8161), ref: 6B9B27A7

Strings

mscoree.dll, xrefs: 6B9B276C
CorExitProcess, xrefs: 6B9B277D

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5af712ea0c50804b4f70ba32a05bea0df81923d7cdeabbdcdf3549718018d3a5
Instruction ID: a8506f2da18991717321396220cb2e31421d111d5e61878afe92e4878b281ed2
Opcode Fuzzy Hash: 5af712ea0c50804b4f70ba32a05bea0df81923d7cdeabbdcdf3549718018d3a5
Instruction Fuzzy Hash: 09014F31918729EFEF018F54CC48FAEBBB9FB05715F004627A821E26A0DB78D901CA94

Uniqueness

Uniqueness Score: -1.00%

Function 6B9D9800 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 6B9D9840

Strings

bad_variant_access.cc, xrefs: 6B9D981A
bad_cast was thrown in -fno-exceptions mode, xrefs: 6B9D9803
Bad variant access, xrefs: 6B9D9813

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Bad variant access$bad_cast was thrown in -fno-exceptions mode$bad_variant_access.cc
API String ID: 4194217158-1323337912
Opcode ID: 5b7f870f1d4e49a16eca5ed01c4768cb4b77e8b1451394dcd92f3d146d0b75ee
Instruction ID: d9171906460adcb225e29824400340eab39d60b7ce7053fda9a7f932cb82ad46
Opcode Fuzzy Hash: 5b7f870f1d4e49a16eca5ed01c4768cb4b77e8b1451394dcd92f3d146d0b75ee
Instruction Fuzzy Hash: C6E02B6550420C37EA1436FAAC03E86765DDB3255CF808079FB0C4B602EAAFF64081F7

Uniqueness

Uniqueness Score: -1.00%

Function 6B9D089C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,6B9D0938,00000000,?,?,?,?,?,6B9D07F6,00000002,FlsGetValue,6BA38A18,6BA38A20), ref: 6B9D08A9
GetLastError.KERNEL32(?,6B9D0938,00000000,?,?,?,?,?,6B9D07F6,00000002,FlsGetValue,6BA38A18,6BA38A20,00000000,?,6B9C17A4), ref: 6B9D08B3
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 6B9D08DB

Strings

api-ms-, xrefs: 6B9D08C0

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d295e6b66c3de2dc7ef1b01c8e698375e089d6fc98f24d3829b31cffea4767da
Instruction ID: c98041da9c97cbc52b65df2df8e0d5a52a6520e573485655e4f12990543e0c14
Opcode Fuzzy Hash: d295e6b66c3de2dc7ef1b01c8e698375e089d6fc98f24d3829b31cffea4767da
Instruction Fuzzy Hash: C6E01A30788704BBFF001FA2DC1AB493F68AB01B44F10C062F91DE80A1D7BBE951A695

Uniqueness

Uniqueness Score: -1.00%

Function 6B9BC0C2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E0FB1D68,00000000,00000000,?), ref: 6B9BC125

Part of subcall function 6B9C999A: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6B9C34C4,?,00000000,-00000008), ref: 6B9C99FB

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6B9BC377
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6B9BC3BD
GetLastError.KERNEL32 ref: 6B9BC460

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4a4bad7f5fe392ba4439843b8b9e661e8075dc37d6f852b9a32e5dd7ab309af1
Instruction ID: 452efa701826310cefb9808b1f2b6e998945586736784604830df03be08b99c8
Opcode Fuzzy Hash: 4a4bad7f5fe392ba4439843b8b9e661e8075dc37d6f852b9a32e5dd7ab309af1
Instruction Fuzzy Hash: 3AD158B5D042489FDF05CFA8C880AAEBBB9EF09714F14856AE465EB351D734E942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B965D00 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 6B965D3D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B965D7A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B965DBE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6B965E22

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery
String ID:
API String ID: 374826692-0
Opcode ID: 73a1f3c8f0e1b136cac261a2214aafb07e473b69ff6bea613b03eb201f67806f
Instruction ID: 2363cedd47ee9006cb80e2c0f65b07f339a12cd851a2a4327edd10bdc634525e
Opcode Fuzzy Hash: 73a1f3c8f0e1b136cac261a2214aafb07e473b69ff6bea613b03eb201f67806f
Instruction Fuzzy Hash: BB315EB1608305AFD708DF68D99992BBBE9EBC9314F00882EF585C7261D774E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B8DBDF0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 6B8DBE19

Part of subcall function 6B9A33F7: EnterCriticalSection.KERNEL32(6BABCF68,?,?,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A3402
Part of subcall function 6B9A33F7: LeaveCriticalSection.KERNEL32(6BABCF68,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A343F

__Init_thread_footer.LIBCMT ref: 6B8DBE48

Part of subcall function 6B9A346D: EnterCriticalSection.KERNEL32(6BABCF68,?,?,6B9DD6B4,6BABFD80), ref: 6B9A3477
Part of subcall function 6B9A346D: LeaveCriticalSection.KERNEL32(6BABCF68,?,6B9DD6B4,6BABFD80), ref: 6B9A34AA
Part of subcall function 6B9A346D: WakeAllConditionVariable.KERNEL32(?,6BABFD80), ref: 6B9A351D

TryAcquireSRWLockExclusive.KERNEL32(00000000), ref: 6B8DBE7D
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 6B8DBEA1

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: CriticalSection$EnterExclusiveLeaveLock$AcquireConditionInit_thread_footerInit_thread_headerReleaseVariableWake
String ID:
API String ID: 1930009111-0
Opcode ID: 27045236b851c75cbb9bd85e148ac3dc2ce59e8498a0c2ec495f6c96c33c3f11
Instruction ID: b7847c12cca2109005b55c750f64b68aa5b5b310647b9e5d61f651324ba90561
Opcode Fuzzy Hash: 27045236b851c75cbb9bd85e148ac3dc2ce59e8498a0c2ec495f6c96c33c3f11
Instruction Fuzzy Hash: 7D214DB2E083549BEF209F399802B5A37A1AB86719F44492EE60547340EF3DE502C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6B963810 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 6B963885
__Init_thread_footer.LIBCMT ref: 6B9638DA
__Init_thread_header.LIBCMT ref: 6B9638EC

Part of subcall function 6B9A33F7: EnterCriticalSection.KERNEL32(6BABCF68,?,?,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A3402
Part of subcall function 6B9A33F7: LeaveCriticalSection.KERNEL32(6BABCF68,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A343F

__Init_thread_footer.LIBCMT ref: 6B96392F

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: CriticalInit_thread_footerInit_thread_headerSection$EnterLeave
String ID:
API String ID: 2234156424-0
Opcode ID: 9972bc4a738fea0ecfb9fc4bf77fa35424fc8616a9659bc53d6c3f6dda021926
Instruction ID: b952b381b40031c6df99d5bcfcc78971214ba63d04f8cfa3d836e4da2908ea68
Opcode Fuzzy Hash: 9972bc4a738fea0ecfb9fc4bf77fa35424fc8616a9659bc53d6c3f6dda021926
Instruction Fuzzy Hash: 8631C4F0988600CFD732DF7CC845B5A77B8F7067A5F008169D52A4B341E739E842CA96

Uniqueness

Uniqueness Score: -1.00%

Function 6B905FC0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 6B905FD7

Strings

Free, xrefs: 6B905FFC
CloseHandle, xrefs: 6B906019
..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc, xrefs: 6B905FF7

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: CloseHandle
String ID: ..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc$CloseHandle$Free
API String ID: 2962429428-1704384866
Opcode ID: 0a91fc3d69bf0f710fd7a806a298daf3e76b021892bd354535adc9457a6ca69f
Instruction ID: f0dc3b0bfd84593cf04651183be19b6dccf6cd968fcefa39b89c363eb38617a7
Opcode Fuzzy Hash: 0a91fc3d69bf0f710fd7a806a298daf3e76b021892bd354535adc9457a6ca69f
Instruction Fuzzy Hash: 49F0F671E00318678F10AE7A9C46DBF3B38AF96608B44405DE91527242DF3CA51587F1

Uniqueness

Uniqueness Score: -1.00%

Function 6B9D237E Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,6B9CBDA2,?,00000001,?,?,?,6B9BC4B4,?,00000000,00000000), ref: 6B9D2395
GetLastError.KERNEL32(?,6B9CBDA2,?,00000001,?,?,?,6B9BC4B4,?,00000000,00000000,?,?,?,6B9BBDFA,?), ref: 6B9D23A1

Part of subcall function 6B9D2400: CloseHandle.KERNEL32(FFFFFFFE,6B9D23B1,?,6B9CBDA2,?,00000001,?,?,?,6B9BC4B4,?,00000000,00000000,?,?), ref: 6B9D2410

___initconout.LIBCMT ref: 6B9D23B1

Part of subcall function 6B9D23D3: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6B9D236F,6B9CBD8F,?,?,6B9BC4B4,?,00000000,00000000,?), ref: 6B9D23E6

WriteConsoleW.KERNEL32(?,?,?,00000000,?,6B9CBDA2,?,00000001,?,?,?,6B9BC4B4,?,00000000,00000000,?), ref: 6B9D23C6

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6da857ab08379a8b6d3d0abeea202dcba34a1ecefb4bfc9622462d5086e26c6b
Instruction ID: f0d1489a373e39e1601d34b967317d5c9810813ae1f71c5844534483c29630b3
Opcode Fuzzy Hash: 6da857ab08379a8b6d3d0abeea202dcba34a1ecefb4bfc9622462d5086e26c6b
Instruction Fuzzy Hash: 8CF01236504B14BBDF221FA1CD04989BF66EF46765B008010FA2995130C635C861EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B9A34B7 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,6B9A341C,00000064), ref: 6B9A34DA
LeaveCriticalSection.KERNEL32(6BABCF68,?,?,6B9A341C,00000064,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A34E4
WaitForSingleObjectEx.KERNEL32(?,00000000,?,6B9A341C,00000064,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A34F5
EnterCriticalSection.KERNEL32(6BABCF68,?,6B9A341C,00000064,?,6B9DD691,6BABFD80,?,6B9DD71A), ref: 6B9A34FC

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: e2b66338374a63d3513f711a11354edb43535e94f143d710a901b7a832cbb34a
Instruction ID: b6e391b606dd92d6c736e11dd3c2a9956f5443627a47d97315ae52e72d05ed58
Opcode Fuzzy Hash: e2b66338374a63d3513f711a11354edb43535e94f143d710a901b7a832cbb34a
Instruction Fuzzy Hash: D4E06D32549328ABDF021F74CC08D9D3E29BB0BA51B0080A9F925561209675D856CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B9C7327 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 6B9C355A: GetLastError.KERNEL32(00000000,?,6B9BFC5D), ref: 6B9C355E
Part of subcall function 6B9C355A: SetLastError.KERNEL32(00000000,?,?,00000016,6B9A8A7B), ref: 6B9C3600

GetACP.KERNEL32(?,?,?,?,?,?,6B9B341C,?,?,?,?,?,-00000050,?,?,?), ref: 6B9C73E6
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6B9B341C,?,?,?,?,?,-00000050,?,?), ref: 6B9C741D

Strings

utf8, xrefs: 6B9C74EF

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: ab4e7710315fb495e40e9fa088f8a5acb073bad55f95a69f04bb3f6041af4b86
Instruction ID: b8669b5123b43c8764762b29fcd516b7d643408f37f7adea764280e2b6edafaa
Opcode Fuzzy Hash: ab4e7710315fb495e40e9fa088f8a5acb073bad55f95a69f04bb3f6041af4b86
Instruction Fuzzy Hash: 4251F671B04301ABE715AB75CC82BA777ACEF45749F00096AE925D70C1E77CE94086A3

Uniqueness

Uniqueness Score: -1.00%

Function 6B8D9550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,00000000,?,00000000,?,6B86EF8F,00000000,00000000), ref: 6B8D9566
ReleaseSRWLockExclusive.KERNEL32(?,..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at,6BA9BC04,?,?,?,00000000,?,00000000,?,6B86EF8F,00000000,00000000), ref: 6B8D96C0

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6B8D96F5

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 17069307-2888085009
Opcode ID: e5d7528caf6f6529b518660116394c16fda7551e608825b7a1a998ad94c90dab
Instruction ID: 2feea43cb20ca7fb1a0714e256f6ff99c1b82719ee39f0286a5c91926a4da082
Opcode Fuzzy Hash: e5d7528caf6f6529b518660116394c16fda7551e608825b7a1a998ad94c90dab
Instruction Fuzzy Hash: 0E518CB1A04209EFDB04CF68D89095AB7F5FF497187014A6AE819EB342E734ED11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B979DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,6B9656DE,00000000,?,00000000,?,6B86F010,00000000), ref: 6B979DD4
GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 6B979DE0

Strings

GetHandleVerifier, xrefs: 6B979DDA

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: 01fd5f25181b89d11f853bba1bc2bb6f1be686a383bb6c25fc9e122f116c29dd
Instruction ID: 348333957d20257ce0bf95750d086c7c844a3f545b6ed6deb8ce6922ff462f0d
Opcode Fuzzy Hash: 01fd5f25181b89d11f853bba1bc2bb6f1be686a383bb6c25fc9e122f116c29dd
Instruction Fuzzy Hash: AFE039312A8304BFFE603B688C4BF253ADEE707B01F504C75B521C6192EBA8D44582B1

Uniqueness

Uniqueness Score: -1.00%

Function 6B8DBA90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6B8DBA9E
GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 6B8DBAAA

Strings

GetHandleVerifier, xrefs: 6B8DBAA4

Memory Dump Source

Source File: 0000000E.00000002.3399244269.000000006B701000.00000020.00000001.01000000.0000001D.sdmp, Offset: 6B700000, based on PE: true

Associated: 0000000E.00000002.3399188049.000000006B700000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399654118.000000006BA33000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399776148.000000006BAB9000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399838229.000000006BABA000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399899159.000000006BABB000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3399941065.000000006BACE000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400013365.000000006BAD3000.00000020.00000001.01000000.0000001D.sdmpDownload File
Associated: 0000000E.00000002.3400088024.000000006BAD6000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b700000_T2RIU3FpH6dczIGTG32vuvvE.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: 43661da20217a81926615bed4eabf425289401b275be00e2355703ce90d7cbac
Instruction ID: d94a308915b01f582fe1d29e7a78850310215d49595881c3a7fb027507c13274
Opcode Fuzzy Hash: 43661da20217a81926615bed4eabf425289401b275be00e2355703ce90d7cbac
Instruction Fuzzy Hash: CFE09235699388AFFE402B758C0AF253798B706B01F404C26F611C71D0EBA8E4458220

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: XEAazEoSTmJSOa66cXm6S07v.exePID: 2668, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	78.1%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	4

Executed Functions

Function 02ED003C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02ED024D

Strings

cess, xrefs: 02ED018D
kernel32.dll, xrefs: 02ED008F, 02ED0095

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c888ef0d310670c98a3f762550467d8ce2b93cc8046e61e9807fb0037b26c9d0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C3526974A41229DFDB64CF68C984BACBBB1BF09314F1480D9E94DAB351DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02FAF5B6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02FAF5DE
Module32First.KERNEL32(00000000,00000224), ref: 02FAF5FE

Memory Dump Source

Source File: 0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp, Offset: 02FAE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2fae000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b82596e25b4c758e9b1a0ce36b6f48ef4ad123c3c066d3fcdda361a1c62d7b52
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1FF0F6716003107FD7303FF89C9CB6F76E8AF49264F100228E742D59C0CB71E8454A60

Uniqueness

Uniqueness Score: -1.00%

Function 02ED0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02ED0223,?,?), ref: 02ED0E19
SetErrorMode.KERNELBASE(00000000,?,?,02ED0223,?,?), ref: 02ED0E1E

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 2728ec6266eccd2df74ccad318daa4bcd13064fc6acaeedfbc78d4ad9a9bc59b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 33D0123114512877DB002AA4DC09BCD7B1CDF05B66F048011FB0DD9080C770954146E5

Uniqueness

Uniqueness Score: -1.00%

Function 02FAF275 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02FAF2C6

Memory Dump Source

Source File: 0000000F.00000002.3375966593.0000000002FAE000.00000040.00000020.00020000.00000000.sdmp, Offset: 02FAE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2fae000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 8b32162c2fe6a59ebdaa549e13d4b3de5f954c84e0529289cfb64ac0c5e66c18
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9C113C79A00208EFDB01DF98C985E98BBF5EF08351F158094FA489B361D775EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042086B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

Part of subcall function 00416D19: _free.LIBCMT ref: 00416D78
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D85

GetUserDefaultLCID.KERNEL32 ref: 00420977
IsValidCodePage.KERNEL32(00000000), ref: 004209D2
IsValidLocale.KERNEL32(?,00000001), ref: 004209E1
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00420A29
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00420A48

Strings

0B, xrefs: 00420924

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: 0B
API String ID: 745075371-4003747729
Opcode ID: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction ID: 650ebaacf82e858368a26b85c64588bb52e0d85139106dd20bcc8c2b817cb8b1
Opcode Fuzzy Hash: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction Fuzzy Hash: 475184B1B002259AEB20DFA5EC45BBF77F8AF04700F94046BE905E7253D7789984CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FF33 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

IsValidCodePage.KERNEL32(00000000), ref: 00420015
_wcschr.LIBVCRUNTIME ref: 004200A5
_wcschr.LIBVCRUNTIME ref: 004200B3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00420156

Strings

0B, xrefs: 0041FFA6

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: 0B
API String ID: 4212172061-4003747729
Opcode ID: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction ID: 96eb391d46ce5fb78e8006d1997cb9303ceaefbbeb856b82c66811b22ec73256
Opcode Fuzzy Hash: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction Fuzzy Hash: CD61F971700216AAE724AB35EC42BEB77E8EF04314F54403FF505D7282EA79E986C768

Uniqueness

Uniqueness Score: -1.00%

Function 00420697 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00420730
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00420759
GetACP.KERNEL32 ref: 0042076E

Strings

ACP, xrefs: 004206B5
OCP, xrefs: 004206EB

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction ID: f807061c0cfb0377689ec6e1dc83ff6a27fcbbb4928d2f32a34ff3ed1f12855e
Opcode Fuzzy Hash: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction Fuzzy Hash: D021D822B00125A7D7308F54E900A9BB3E6AFD0F50BD68076E90AD7312E736ED41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02EF08FE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 02EF0997
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 02EF09C0
GetACP.KERNEL32 ref: 02EF09D5

Strings

OCP, xrefs: 02EF0952
ACP, xrefs: 02EF091C

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction ID: e5948c2133b90ab2ddacd0bcff15ee9f77810f6984c865c815b2e5c5f31962e6
Opcode Fuzzy Hash: 2f8ee967946dfbb9997fc3c3bc2472c999760cc1c46ecdade7a51e654396b61a
Instruction Fuzzy Hash: 0C21C922781101EAF7B18F55C800B9773A6ABE0E68B46D464EE49D710BF732D940C394

Uniqueness

Uniqueness Score: -1.00%

Function 02EF0AD2 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 02EE6F80: GetLastError.KERNEL32(?,?,02EDE697,?,?,?,02EDED94,?), ref: 02EE6F84
Part of subcall function 02EE6F80: _free.LIBCMT ref: 02EE6FB7
Part of subcall function 02EE6F80: SetLastError.KERNEL32(00000000), ref: 02EE6FF8
Part of subcall function 02EE6F80: _abort.LIBCMT ref: 02EE6FFE

Part of subcall function 02EE6F80: _free.LIBCMT ref: 02EE6FDF
Part of subcall function 02EE6F80: SetLastError.KERNEL32(00000000), ref: 02EE6FEC

GetUserDefaultLCID.KERNEL32 ref: 02EF0BDE
IsValidCodePage.KERNEL32(00000000), ref: 02EF0C39
IsValidLocale.KERNEL32(?,00000001), ref: 02EF0C48
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 02EF0C90
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 02EF0CAF

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction ID: b4c6db94c10d8e7c19692af81fc21136a5983208099019d4029a853f1e5d300d
Opcode Fuzzy Hash: f8dfd3e45c7171820dfa425feb9c1a2a63e1685b7cd510425c95f259fcd5efdc
Instruction Fuzzy Hash: CE51A071A80215ABDF60DFA5CC50ABEB3B9FF04709F44D079EA14E7196EB709904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 004123A0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

y%B, xrefs: 00412808, 004125F2, 00412481
y%B, xrefs: 004123BD, 00412568, 0041278C, 00412726, 004125B6, 00412544

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID: y%B$y%B
API String ID: 0-2510245575
Opcode ID: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction ID: 7f81a5055d29d3c9b3a65b9dd9c97bea9b47a5c616e9cad61c519a63aba044dd
Opcode Fuzzy Hash: 639d753ca5804acfb26a7323c6b70442fdf5003eed0a35c333bc141f8f4a1fb1
Instruction Fuzzy Hash: F8024C71E002199FDF14CFA9D9806EEB7F1FF88314F25826AD819E7380D774AA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 02EF019A Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 02EE6F80: GetLastError.KERNEL32(?,?,02EDE697,?,?,?,02EDED94,?), ref: 02EE6F84
Part of subcall function 02EE6F80: _free.LIBCMT ref: 02EE6FB7
Part of subcall function 02EE6F80: SetLastError.KERNEL32(00000000), ref: 02EE6FF8
Part of subcall function 02EE6F80: _abort.LIBCMT ref: 02EE6FFE

IsValidCodePage.KERNEL32(00000000), ref: 02EF027C
_wcschr.LIBVCRUNTIME ref: 02EF030C
_wcschr.LIBVCRUNTIME ref: 02EF031A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 02EF03BD

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction ID: 135f0f8f946295d1929c79352db1b1d8749df856136c649ad0cd7bfc14767353
Opcode Fuzzy Hash: a67f0c87ba5b0233321a1933dfd54815027aea6e1cb45a6db47d5a69fa3d4796
Instruction Fuzzy Hash: 1C611C72685206ABEB64AB74CC41BBB73ACEF04304F14D069FB09D7186EB70E940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00411F6A Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00411FDA
_free.LIBCMT ref: 00411FF0
_free.LIBCMT ref: 00412001
_free.LIBCMT ref: 00412012
_free.LIBCMT ref: 00412029
GetCPInfo.KERNEL32(?,?), ref: 00412071

Part of subcall function 0041B14E: _free.LIBCMT ref: 0041B1B9

_free.LIBCMT ref: 0041221D
_free.LIBCMT ref: 00412230
_free.LIBCMT ref: 0041223E
_free.LIBCMT ref: 00412249
_free.LIBCMT ref: 0041228B
_free.LIBCMT ref: 00412293
_free.LIBCMT ref: 0041229B
_free.LIBCMT ref: 004122A3
_free.LIBCMT ref: 004122B1

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 9d037bec24c39842fdb41d63d06b61860568da7267ea86be451b4e4681316e80
Instruction ID: 8ae6142132af87c7e5682a7a588f5480999d86aced5f895244e8bf3117bae5a7
Opcode Fuzzy Hash: 9d037bec24c39842fdb41d63d06b61860568da7267ea86be451b4e4681316e80
Instruction Fuzzy Hash: 0DB1C171900309AFDB10DF65C881BEEBBF5BF48304F14416EF959E7242D7B9A8918B64

Uniqueness

Uniqueness Score: -1.00%

Function 02EE21D1 Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 02EE2241
_free.LIBCMT ref: 02EE2257
_free.LIBCMT ref: 02EE2268
_free.LIBCMT ref: 02EE2279
_free.LIBCMT ref: 02EE2290
GetCPInfo.KERNEL32(?,?), ref: 02EE22D8

Part of subcall function 02EEB3B5: _free.LIBCMT ref: 02EEB420

_free.LIBCMT ref: 02EE2484
_free.LIBCMT ref: 02EE2497
_free.LIBCMT ref: 02EE24A5
_free.LIBCMT ref: 02EE24B0
_free.LIBCMT ref: 02EE24F2
_free.LIBCMT ref: 02EE24FA
_free.LIBCMT ref: 02EE2502
_free.LIBCMT ref: 02EE250A
_free.LIBCMT ref: 02EE2518

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: e97052e7d5d39c2e49c6ef11ebcd5deb8362bed3d67f9f3722abe09ca1aa8c7f
Instruction ID: ceb527e763ee62eba296cb5e95a756e7f38d103a0fc678c7c241bd248c98a16e
Opcode Fuzzy Hash: e97052e7d5d39c2e49c6ef11ebcd5deb8362bed3d67f9f3722abe09ca1aa8c7f
Instruction Fuzzy Hash: FBB1A0719402059FDF21DFB5C880BEEBBF9BF08308F149469FA9AA7241DB7598458F60

Uniqueness

Uniqueness Score: -1.00%

Function 0041F521 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 0041F565

Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8D1
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8E3
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E8F5
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E907
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E919
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E92B
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E93D
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E94F
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E961
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E973
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E985
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E997
Part of subcall function 0041E8B4: _free.LIBCMT ref: 0041E9A9

_free.LIBCMT ref: 0041F55A

Part of subcall function 0041629A: HeapFree.KERNEL32(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F57C
_free.LIBCMT ref: 0041F591
_free.LIBCMT ref: 0041F59C
_free.LIBCMT ref: 0041F5BE
_free.LIBCMT ref: 0041F5D1
_free.LIBCMT ref: 0041F5DF
_free.LIBCMT ref: 0041F5EA
_free.LIBCMT ref: 0041F622
_free.LIBCMT ref: 0041F629
_free.LIBCMT ref: 0041F646
_free.LIBCMT ref: 0041F65E

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction ID: 316693fb469aea39a39253a8fd8e6cc64fc1a93db8be5688e07109e7d5df04fe
Opcode Fuzzy Hash: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction Fuzzy Hash: 33316C71500700AFEB20AE7AE845BD773E9FF44318F15446BE849D7262DA79ECC68A18

Uniqueness

Uniqueness Score: -1.00%

Function 02EEF788 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 02EEF7CC

Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB38
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB4A
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB5C
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB6E
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB80
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEB92
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBA4
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBB6
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBC8
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBDA
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBEC
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEBFE
Part of subcall function 02EEEB1B: _free.LIBCMT ref: 02EEEC10

_free.LIBCMT ref: 02EEF7C1

Part of subcall function 02EE6501: HeapFree.KERNEL32(00000000,00000000,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?), ref: 02EE6517
Part of subcall function 02EE6501: GetLastError.KERNEL32(?,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?,?), ref: 02EE6529

_free.LIBCMT ref: 02EEF7E3
_free.LIBCMT ref: 02EEF7F8
_free.LIBCMT ref: 02EEF803
_free.LIBCMT ref: 02EEF825
_free.LIBCMT ref: 02EEF838
_free.LIBCMT ref: 02EEF846
_free.LIBCMT ref: 02EEF851
_free.LIBCMT ref: 02EEF889
_free.LIBCMT ref: 02EEF890
_free.LIBCMT ref: 02EEF8AD
_free.LIBCMT ref: 02EEF8C5

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction ID: 1a5008ae924ed9d8b10f6ab703331486876530f25f497bee5f6b955a93b44fd9
Opcode Fuzzy Hash: b9175880c53cb61b75c7f783674dde5ef8178fe79d68c96236a7112e5c5498ca
Instruction Fuzzy Hash: 393181326807019FEF709A78D888B5673EAEF00318F24E829E56AD7594EF71E944CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B2 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E9FA
_free.LIBCMT ref: 0041EA1E
_free.LIBCMT ref: 0041EA2B
_free.LIBCMT ref: 0041EA50
_free.LIBCMT ref: 0041EA5D
_free.LIBCMT ref: 0041EA66
_free.LIBCMT ref: 0041ED44
_free.LIBCMT ref: 0041ED4C

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ede1a756fe7c81b57652e01e6694f4d5898de535ff9c24b5680a7aebf79362e9
Instruction ID: 728dd4b73fa8875da2944d3c1161fea0547f625c3b5c38e136dc442d3870b7dc
Opcode Fuzzy Hash: ede1a756fe7c81b57652e01e6694f4d5898de535ff9c24b5680a7aebf79362e9
Instruction Fuzzy Hash: 63C16376D40204BBDB20DFA9CC43FDA77F8AB48744F15416AFE05EB282E6749D818794

Uniqueness

Uniqueness Score: -1.00%

Function 0041A242 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00419F10: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00419F2D

GetLastError.KERNEL32 ref: 0041A356
__dosmaperr.LIBCMT ref: 0041A35D
GetFileType.KERNEL32(00000000), ref: 0041A369
GetLastError.KERNEL32 ref: 0041A373
__dosmaperr.LIBCMT ref: 0041A37C
CloseHandle.KERNEL32(00000000), ref: 0041A39C
CloseHandle.KERNEL32(?), ref: 0041A4E6
GetLastError.KERNEL32 ref: 0041A518
__dosmaperr.LIBCMT ref: 0041A51F

Strings

H, xrefs: 0041A4A4

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d610beb6fdae7f59e9ad9f33e2ca6ec6ebc0d6293e5c15d19bd92f4cf96793f
Instruction ID: 5ed0b96f73270941775a85281cb99d597b6a4d56659bde6f01148d564b9c2f2b
Opcode Fuzzy Hash: 3d610beb6fdae7f59e9ad9f33e2ca6ec6ebc0d6293e5c15d19bd92f4cf96793f
Instruction Fuzzy Hash: DDA15732A041089FDF189F78D8517EE3BA1AF06324F18015EEC51EB391D7398D66C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00423226 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042422F), ref: 00423249

Strings

/BB, xrefs: 0042342E
exp, xrefs: 0042330E, 00423370
pow, xrefs: 0042332D, 004233D9, 004233EC
sqrt, xrefs: 004233CD
log10, xrefs: 00423293, 004232E3
log, xrefs: 004232EF, 004232FB
acos, xrefs: 004233C1
asin, xrefs: 004233B5

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: DecodePointer
String ID: /BB$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-1021189420
Opcode ID: 88552b8886f88d94b8d1bbcc7aafbfab123f3002aa15034899b0489058aea16a
Instruction ID: 5f418b0c94ccf72204288f9fbe243b868e613e1cea8606976bda72b47a9d9e27
Opcode Fuzzy Hash: 88552b8886f88d94b8d1bbcc7aafbfab123f3002aa15034899b0489058aea16a
Instruction Fuzzy Hash: 06518E70B00529CBDB10DFA9F9481AD7BB0FB49305FE44197E881A6254CB7D8B65CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C25 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416C39

Part of subcall function 0041629A: HeapFree.KERNEL32(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 00416C45
_free.LIBCMT ref: 00416C50
_free.LIBCMT ref: 00416C5B
_free.LIBCMT ref: 00416C66
_free.LIBCMT ref: 00416C71
_free.LIBCMT ref: 00416C7C
_free.LIBCMT ref: 00416C87
_free.LIBCMT ref: 00416C92
_free.LIBCMT ref: 00416CA0

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction ID: 425b14d8582b8484cae793816d5f4fa8e3af98928aded5048720e3a5ca7bcabf
Opcode Fuzzy Hash: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction Fuzzy Hash: B311E976100218BFDF01FF95D952DD93B65EF48358B4280AAFD088F222DA35EE919B84

Uniqueness

Uniqueness Score: -1.00%

Function 02EE6E8C Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02EE6EA0

Part of subcall function 02EE6501: HeapFree.KERNEL32(00000000,00000000,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?), ref: 02EE6517
Part of subcall function 02EE6501: GetLastError.KERNEL32(?,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?,?), ref: 02EE6529

_free.LIBCMT ref: 02EE6EAC
_free.LIBCMT ref: 02EE6EB7
_free.LIBCMT ref: 02EE6EC2
_free.LIBCMT ref: 02EE6ECD
_free.LIBCMT ref: 02EE6ED8
_free.LIBCMT ref: 02EE6EE3
_free.LIBCMT ref: 02EE6EEE
_free.LIBCMT ref: 02EE6EF9
_free.LIBCMT ref: 02EE6F07

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction ID: 2294f780aff58b7bf9923c32b15b0629f9fc35a074b4b279633474d6b7c924c0
Opcode Fuzzy Hash: b4e3df1a2592718950074ff961ccd1fa3b04f250d0db4e1414e8dc6a3248423b
Instruction Fuzzy Hash: AF11E376240008BFCF51EF95C844CDD3BAAEF14354B4198A1FA0A8F238DA32EA549F81

Uniqueness

Uniqueness Score: -1.00%

Function 004011B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004011B5
std::_Lockit::_Lockit.LIBCPMT ref: 004011C7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00401204

Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407E99
Part of subcall function 00407E7A: _Yarn.LIBCPMT ref: 00407EBD

std::bad_exception::bad_exception.LIBCMT ref: 00401225
__CxxThrowException@8.LIBVCRUNTIME ref: 00401233
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00401256
std::_Lockit::~_Lockit.LIBCPMT ref: 004012C7

Strings

bad locale name, xrefs: 0040121D

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 835844855-1405518554
Opcode ID: a090f8b72b9f032088bcf3b84daf861ba69faf3822e33b89ac944a869e89cca2
Instruction ID: 9bdc7579a9a3bc6ca601cd004726ed2944731520d9260611c740ec4211b797ca
Opcode Fuzzy Hash: a090f8b72b9f032088bcf3b84daf861ba69faf3822e33b89ac944a869e89cca2
Instruction Fuzzy Hash: 5D319F31904B40DEC731AF6AD941A5BFBF4BF08714B508A7FE04AA3AA1C738B504CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02ED43F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED43F5
std::_Lockit::_Lockit.LIBCPMT ref: 02ED4404
int.LIBCPMT ref: 02ED441B

Part of subcall function 02ED157F: std::_Lockit::_Lockit.LIBCPMT ref: 02ED1590
Part of subcall function 02ED157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02ED15AA

std::locale::_Getfacet.LIBCPMT ref: 02ED4424
std::_Facet_Register.LIBCPMT ref: 02ED4455
std::_Lockit::~_Lockit.LIBCPMT ref: 02ED446B
__CxxThrowException@8.LIBVCRUNTIME ref: 02ED4491

Strings

_vB, xrefs: 02ED43F0

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction ID: 0b10bdb3c937a9437f4f5638ebd8d0f6f6cd901b0e244c3f9cce1c2c95172d64
Opcode Fuzzy Hash: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction Fuzzy Hash: 301127729802288BCF11EBA4D804AEDB776EF94324F14D419F815A72D0DB349A02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED385C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED3861
std::_Lockit::_Lockit.LIBCPMT ref: 02ED3870
int.LIBCPMT ref: 02ED3887

Part of subcall function 02ED157F: std::_Lockit::_Lockit.LIBCPMT ref: 02ED1590
Part of subcall function 02ED157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02ED15AA

std::locale::_Getfacet.LIBCPMT ref: 02ED3890
std::_Facet_Register.LIBCPMT ref: 02ED38C1
std::_Lockit::~_Lockit.LIBCPMT ref: 02ED38D7
__CxxThrowException@8.LIBVCRUNTIME ref: 02ED38FD

Strings

_vB, xrefs: 02ED385C

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction ID: 8a5f1cc777b0594a4bae4e344677adc6b1efc06ef66993013ce6405c097b7841
Opcode Fuzzy Hash: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction Fuzzy Hash: B6110A76D801249BCB11FB94D804AEDB776EF44715F14946AF415B72D0DB748902CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02ED3651 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED3656
std::_Lockit::_Lockit.LIBCPMT ref: 02ED3665
int.LIBCPMT ref: 02ED367C

Part of subcall function 02ED157F: std::_Lockit::_Lockit.LIBCPMT ref: 02ED1590
Part of subcall function 02ED157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02ED15AA

std::locale::_Getfacet.LIBCPMT ref: 02ED3685
std::_Facet_Register.LIBCPMT ref: 02ED36B6
std::_Lockit::~_Lockit.LIBCPMT ref: 02ED36CC
__CxxThrowException@8.LIBVCRUNTIME ref: 02ED36F2

Strings

_vB, xrefs: 02ED3651

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID: _vB
API String ID: 1202896665-2031504979
Opcode ID: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction ID: 11fa10a2d88eca3210743461d76af661ff520aef27b842efa1bf33c3b148c064
Opcode Fuzzy Hash: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction Fuzzy Hash: D4110A769801249BCB15EBA4C804AEEB776EF84364F149459F425773D0CB748902CF92

Uniqueness

Uniqueness Score: -1.00%

Function 004192AD Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26c3a26d84435dadb32eec829eed0824bf3e56cab88ec35bc99dc9cc53e9ab8
Instruction ID: ad7a334a3c542fe0f14731be173b353b81adde24e2ae5a0363ed5934dc533936
Opcode Fuzzy Hash: c26c3a26d84435dadb32eec829eed0824bf3e56cab88ec35bc99dc9cc53e9ab8
Instruction Fuzzy Hash: 72C11A71D04249AFDB11CFA9C850BEE7BB1BF09314F08419AE854B7392C7789D81CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02EE9514 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c333506b60f9a2cbe16c25422fb5c8dc001c6824b257e592f442b80053a19a3
Instruction ID: 0ad29d19ae87f8a079fc49a7b465df46a5c90ab3fcfcfe7294c94f0485559d99
Opcode Fuzzy Hash: 1c333506b60f9a2cbe16c25422fb5c8dc001c6824b257e592f442b80053a19a3
Instruction Fuzzy Hash: 73C106B0E842499FDF11CFA8D851BEDBBF5AF09314F08A494E952A73A2C7308945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00414A4A Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416D19: GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
Part of subcall function 00416D19: _free.LIBCMT ref: 00416D50
Part of subcall function 00416D19: SetLastError.KERNEL32(00000000), ref: 00416D91
Part of subcall function 00416D19: _abort.LIBCMT ref: 00416D97

_memcmp.LIBVCRUNTIME ref: 00414CF4
_free.LIBCMT ref: 00414D65
_free.LIBCMT ref: 00414D7E
_free.LIBCMT ref: 00414DB0
_free.LIBCMT ref: 00414DB9
_free.LIBCMT ref: 00414DC5

Strings

C, xrefs: 00414BB2

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 8f87c09ea476144f3408270848766069dd2a72959f888511d1f2eb11bfac3621
Instruction ID: af268d229fb851bfdfa469d3d7016fc6fe3b7b40d7c0f50ff16bf374563e7c73
Opcode Fuzzy Hash: 8f87c09ea476144f3408270848766069dd2a72959f888511d1f2eb11bfac3621
Instruction Fuzzy Hash: 7CB12975A016199BDB24DF18D884BEEB7B4FF88304F6045AAE809A7350E735AED1CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02EE4CB1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02EE6F80: GetLastError.KERNEL32(?,?,02EDE697,?,?,?,02EDED94,?), ref: 02EE6F84
Part of subcall function 02EE6F80: _free.LIBCMT ref: 02EE6FB7
Part of subcall function 02EE6F80: SetLastError.KERNEL32(00000000), ref: 02EE6FF8
Part of subcall function 02EE6F80: _abort.LIBCMT ref: 02EE6FFE

_memcmp.LIBVCRUNTIME ref: 02EE4F5B
_free.LIBCMT ref: 02EE4FCC
_free.LIBCMT ref: 02EE4FE5
_free.LIBCMT ref: 02EE5017
_free.LIBCMT ref: 02EE5020
_free.LIBCMT ref: 02EE502C

Strings

C, xrefs: 02EE4E19

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 2dcdab9ff37da07fbf13cf7196123cc144f196f64e2833b55e76e053da9afdf4
Instruction ID: f657194ac14b1eb43c1bd800a531b195a0778d17fb4e1eef89f31f698c1f3bd1
Opcode Fuzzy Hash: 2dcdab9ff37da07fbf13cf7196123cc144f196f64e2833b55e76e053da9afdf4
Instruction Fuzzy Hash: 20B14B75A412199FDF24DF18C884BADB3B5FF48308F5095AAE90AA7394D731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0041673F Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0040F850,0040F850,?,?,?,00416990,00000001,00000001,F5E85006), ref: 00416799
__alloca_probe_16.LIBCMT ref: 004167D1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00416990,00000001,00000001,F5E85006,?,?,?), ref: 0041681F
__alloca_probe_16.LIBCMT ref: 004168B6
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00416919
__freea.LIBCMT ref: 00416926

Part of subcall function 00417A45: HeapAlloc.KERNEL32(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

__freea.LIBCMT ref: 0041692F
__freea.LIBCMT ref: 00416954

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: f9eec1d03ef488200257542b3a30a4a1c023565d73c6751b204851a68cbc467a
Instruction ID: 3d3e7015d1c5c7bc026f1fbb08fe6865a4c6ffd2cfadb9c0ba95752873af972a
Opcode Fuzzy Hash: f9eec1d03ef488200257542b3a30a4a1c023565d73c6751b204851a68cbc467a
Instruction Fuzzy Hash: 4751F5B2610216ABDB259F65CC41EFF7BA9EF40754F16462EFD04D6280DB38DC80C668

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDD7 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041EE46
_free.LIBCMT ref: 0041EE54
_free.LIBCMT ref: 0041EF82
_free.LIBCMT ref: 0041EF8D

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e68a25c084fc20a1e1d7f08a61fe8f3dbfc97445b378353a219a7845841ba709
Instruction ID: 73c135ea74765e4518f9d8ef1c60bb5e0d099e6adef79961ba2dbed29d3485ac
Opcode Fuzzy Hash: e68a25c084fc20a1e1d7f08a61fe8f3dbfc97445b378353a219a7845841ba709
Instruction Fuzzy Hash: 8C61A076904305AFDB20DF66C842BDABBF4EF48710F1441ABEC45EB281D7749D828B98

Uniqueness

Uniqueness Score: -1.00%

Function 02EEF03E Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02EEF0AD
_free.LIBCMT ref: 02EEF0BB
_free.LIBCMT ref: 02EEF1E9
_free.LIBCMT ref: 02EEF1F4

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f8833a0de0791504dabcccc7c771c2f5db8e414cd847f9ac854e63f406939190
Instruction ID: e9583a5ec6ec707344b9a7803d9e8a5fa4421af4aff76ad962fb17578650e2fb
Opcode Fuzzy Hash: f8833a0de0791504dabcccc7c771c2f5db8e414cd847f9ac854e63f406939190
Instruction Fuzzy Hash: F161E572D80209AFDF20DFA4C841B9ABBF5EF48314F14956AE946EB245EB709D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00415A13 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,00416188,?,?,?,?,?,?), ref: 00415A55
__fassign.LIBCMT ref: 00415AD0
__fassign.LIBCMT ref: 00415AEB
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 00415B11
WriteFile.KERNEL32(?,?,00000000,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B30
WriteFile.KERNEL32(?,?,00000001,00416188,00000000,?,?,?,?,?,?,?,?,?,00416188,?), ref: 00415B69

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ae6401f21b7801d045f97308b9b06165aa02294ae80e5cf11490d6b3e53dbacb
Instruction ID: 407e3908cef374265deb6243eed94e9e176cff0c31ef9f6c7349134872b618e9
Opcode Fuzzy Hash: ae6401f21b7801d045f97308b9b06165aa02294ae80e5cf11490d6b3e53dbacb
Instruction Fuzzy Hash: 725105B0A04608DFDB10CFA8D881AEEBBF8EF49310F14416BE955F3251D774A981CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02EE5C7A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,02EE63EF,?,?,?,?,?,?), ref: 02EE5CBC
__fassign.LIBCMT ref: 02EE5D37
__fassign.LIBCMT ref: 02EE5D52
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 02EE5D78
WriteFile.KERNEL32(?,?,00000000,02EE63EF,00000000,?,?,?,?,?,?,?,?,?,02EE63EF,?), ref: 02EE5D97
WriteFile.KERNEL32(?,?,00000001,02EE63EF,00000000,?,?,?,?,?,?,?,?,?,02EE63EF,?), ref: 02EE5DD0

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bcc7f49e5f9acd1ab4da29e29a7effa70e0c752b6185b76a6d92c3c1d252d699
Instruction ID: 9adc4f03b324f0597f062fa3b07de8ed385f3906b756a6a1f10cc421d12b243d
Opcode Fuzzy Hash: bcc7f49e5f9acd1ab4da29e29a7effa70e0c752b6185b76a6d92c3c1d252d699
Instruction Fuzzy Hash: 4751E470A402459FDF10CFA8DC84AEEBBF8EF09318F14906AE946F7290D7309951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040C7B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040C7DB
___except_validate_context_record.LIBVCRUNTIME ref: 0040C7E3
_ValidateLocalCookies.LIBCMT ref: 0040C871
__IsNonwritableInCurrentImage.LIBCMT ref: 0040C89C
_ValidateLocalCookies.LIBCMT ref: 0040C8F1

Strings

csm, xrefs: 0040C886

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction ID: 3eebbe8c3ad0fa61f276611c5937d4e28261350d7e8d9123906714334ee199f9
Opcode Fuzzy Hash: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction Fuzzy Hash: 59418235E00208DBCB10EF69C880A9EBBB5AF45325F14C27BE8156B3D1D7399945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 02ED1417 Relevance: 10.6, APIs: 7, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED141C
std::_Lockit::_Lockit.LIBCPMT ref: 02ED142E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 02ED146B

Part of subcall function 02ED80E1: _Yarn.LIBCPMT ref: 02ED8100
Part of subcall function 02ED80E1: _Yarn.LIBCPMT ref: 02ED8124

std::bad_exception::bad_exception.LIBCMT ref: 02ED148C
__CxxThrowException@8.LIBVCRUNTIME ref: 02ED149A
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 02ED14BD
std::_Lockit::~_Lockit.LIBCPMT ref: 02ED152E

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID:
API String ID: 835844855-0
Opcode ID: d4016aa6201875b868c5713db93660535a29781f4af20a4f0b734588d552bf06
Instruction ID: 8582e8e7f4c7f674fea09a85a9b2942b7431ace7270130e2911735b066c0af5e
Opcode Fuzzy Hash: d4016aa6201875b868c5713db93660535a29781f4af20a4f0b734588d552bf06
Instruction Fuzzy Hash: 00317A72844B009FC731AF69E84065AFBF5FF48714B10DA2FE08B96A40CB74A606CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00425FFF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426004
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,0043AE60,SOFTWARE\BroomCleaner), ref: 0042602C
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,0043AE60,0043AE61,Installed,Installed), ref: 004260AF
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 004260D0

Strings

SOFTWARE\BroomCleaner, xrefs: 0042600C, 0042601F
Installed, xrefs: 0042600E, 0042603C, 0042605B, 0042605C

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction ID: 88d0ffafad339e53c26632b4546833d70425ff8bf3c95ccbaa1921ace6490f97
Opcode Fuzzy Hash: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction Fuzzy Hash: E431A771A00228AFDB148FA8DC94AFEBB78FB08358F44012EE802B3281C7B51D05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004227A8 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3a417481234f6a5cce791f459c1180441bcfe0ab5ce7d00eccf100f1f65345
Instruction ID: 9c8ef9f1e7886cc92e32ce44b389b8283dd6e8511c6332daddb66b94c38c2fe8
Opcode Fuzzy Hash: da3a417481234f6a5cce791f459c1180441bcfe0ab5ce7d00eccf100f1f65345
Instruction Fuzzy Hash: 8E11E7726081257BDB203FB39D059AF3B6CEF92764751062EFC15D6251DEBCC88282B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041EFF3: _free.LIBCMT ref: 0041F01C

_free.LIBCMT ref: 0041F2FA

Part of subcall function 0041629A: HeapFree.KERNEL32(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041F305
_free.LIBCMT ref: 0041F310
_free.LIBCMT ref: 0041F364
_free.LIBCMT ref: 0041F36F
_free.LIBCMT ref: 0041F37A
_free.LIBCMT ref: 0041F385

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction ID: be7813cec9e76b844f682d4c097dbd82c10abeb52ecb146189267b1763b940f2
Opcode Fuzzy Hash: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction Fuzzy Hash: 1F114272541B24B6D920BB72DC07FCBB7DCBF44708F40081EBE9E66052DA7DB5868654

Uniqueness

Uniqueness Score: -1.00%

Function 02EEF513 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02EEF25A: _free.LIBCMT ref: 02EEF283

_free.LIBCMT ref: 02EEF561

Part of subcall function 02EE6501: HeapFree.KERNEL32(00000000,00000000,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?), ref: 02EE6517
Part of subcall function 02EE6501: GetLastError.KERNEL32(?,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?,?), ref: 02EE6529

_free.LIBCMT ref: 02EEF56C
_free.LIBCMT ref: 02EEF577
_free.LIBCMT ref: 02EEF5CB
_free.LIBCMT ref: 02EEF5D6
_free.LIBCMT ref: 02EEF5E1
_free.LIBCMT ref: 02EEF5EC

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction ID: dc884901472d71ae28b1c16321955e28cd3820808e27551ce4b78f2fe6e31e76
Opcode Fuzzy Hash: 501a0837026fe0814ab2d6a77f43a53b196c1575d4fb2c1b0167c2d280276289
Instruction Fuzzy Hash: 23115472580B04AADE30B7B0CC4AFCB7B9E6F48701F409C15B79F66454EB65F5044E92

Uniqueness

Uniqueness Score: -1.00%

Function 00404189 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040418E
std::_Lockit::_Lockit.LIBCPMT ref: 0040419D
int.LIBCPMT ref: 004041B4

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 004041BD
std::_Facet_Register.LIBCPMT ref: 004041EE
std::_Lockit::~_Lockit.LIBCPMT ref: 00404204
__CxxThrowException@8.LIBVCRUNTIME ref: 0040422A

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction ID: 83cc51774d47ba4475a281f6d7b020c526a0fd19fbdba44bd5d3cb2c7b641a00
Opcode Fuzzy Hash: fc346c96f50ffa0ae8417ee06a27fb1f11bc101e5f50617f2bcd0e538bf8945f
Instruction Fuzzy Hash: EC110871A001289BCB04EBA4DC06AEE7774EF84358F10057FF915772D1DB389900C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004033EA Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004033EF
std::_Lockit::_Lockit.LIBCPMT ref: 004033FE
int.LIBCPMT ref: 00403415

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 0040341E
std::_Facet_Register.LIBCPMT ref: 0040344F
std::_Lockit::~_Lockit.LIBCPMT ref: 00403465
__CxxThrowException@8.LIBVCRUNTIME ref: 0040348B

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction ID: 705b121528f6e187a552e9d34ae6b3df2024d0ee7a8324a724e42d77b9682124
Opcode Fuzzy Hash: 24ac42d491a15661983952bfe5964fcfc5bf883f37f088e85fec32acd73a0a07
Instruction Fuzzy Hash: B311C4329001289BCB05EFA8C805AEE7B78EF84359F10452FF811772D1DB789A00CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004035F5 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004035FA
std::_Lockit::_Lockit.LIBCPMT ref: 00403609
int.LIBCPMT ref: 00403620

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 00403629
std::_Facet_Register.LIBCPMT ref: 0040365A
std::_Lockit::~_Lockit.LIBCPMT ref: 00403670
__CxxThrowException@8.LIBVCRUNTIME ref: 00403696

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction ID: 4997e6bde17a0f635c2d016693c2f4113915c820df16c93ef0ac66c49e5cddc6
Opcode Fuzzy Hash: 3d358693115aeff1749e0ee4b38daaf9f72a0ca6830b75372d93bcd920b392a7
Instruction Fuzzy Hash: DE11B232A001249BCB14EFA9C805AEE7B78AF44759F10452FF811773D1DB389A04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 02EE69A6 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,02EE6BF7,00000001,00000001,?), ref: 02EE6A00
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,02EE6BF7,00000001,00000001,?,?,?,?), ref: 02EE6A86
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 02EE6B80
__freea.LIBCMT ref: 02EE6B8D

Part of subcall function 02EE7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02EE7CDE

__freea.LIBCMT ref: 02EE6B96
__freea.LIBCMT ref: 02EE6BBB

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 0f73ec244de15a6da3a369d6d53f2abaa512a9059a296f3a28781672e1b0d4f4
Instruction ID: 3237214a548b640d1fd0f06faf0dafe03a1ef782100ed3d36acf61af36d73120
Opcode Fuzzy Hash: 0f73ec244de15a6da3a369d6d53f2abaa512a9059a296f3a28781672e1b0d4f4
Instruction Fuzzy Hash: 0551E472A80216ABDF254F64CC90EAF77AEEB64758F159628FD06D7140EB35EC80C750

Uniqueness

Uniqueness Score: -1.00%

Function 00411A6C Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00411A98
__cftoe.LIBCMT ref: 00411ACA

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: a485617db110597ec1b9df0d6f289f1fb0bfa04032b722232bc564a93a62f50a
Instruction ID: a06c4f6ae663fca8f796a33128cbcfeb149533fe63f1b311835a711b56a71280
Opcode Fuzzy Hash: a485617db110597ec1b9df0d6f289f1fb0bfa04032b722232bc564a93a62f50a
Instruction Fuzzy Hash: 4951FD72904205ABDF209B699D41EEF77A99F48364F10011FFA15962A2EB3DDD80C65C

Uniqueness

Uniqueness Score: -1.00%

Function 02EE1CD3 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 02EE1CFF
__cftoe.LIBCMT ref: 02EE1D31

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: e4bf59b0ec1b744cc32f8c0c94128242877339c1908a2c1c4c186e4d7dced7e5
Instruction ID: 225bbe8587d270a3f7c4159913cf7d856c85cafcf9dc6fdf6dadbcc9b6424802
Opcode Fuzzy Hash: e4bf59b0ec1b744cc32f8c0c94128242877339c1908a2c1c4c186e4d7dced7e5
Instruction Fuzzy Hash: 41511D72940205ABDF346B698C44FBE77A9EF49369F10E219F81FDA190DB71DD80CA60

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9B5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040C9AC,0040A25B), ref: 0040C9C3
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040C9D1
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040C9EA
SetLastError.KERNEL32(00000000,?,0040C9AC,0040A25B), ref: 0040CA3C

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dda85f426682c11d9b33ef5ba38ffa0ea102861d0ad458e8535b07384916c05f
Instruction ID: 6f2bd147e8afdd7a043ddb4cc032e70cd0d7bbdad2502d4e2c804448eb78ecb9
Opcode Fuzzy Hash: dda85f426682c11d9b33ef5ba38ffa0ea102861d0ad458e8535b07384916c05f
Instruction Fuzzy Hash: 3D01F57260D215AEE63857B5BDC5B6B2665DB01378320033FF214B02F0EEBD4C06955C

Uniqueness

Uniqueness Score: -1.00%

Function 02EDCC1C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02EDCC13,02EDA4C2), ref: 02EDCC2A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02EDCC38
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02EDCC51
SetLastError.KERNEL32(00000000,?,02EDCC13,02EDA4C2), ref: 02EDCCA3

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 830170af9e05d3dbdbf0f1320e03d58499cc30579d0bb48bb262cb75337020d8
Instruction ID: 9af0209c8da1e5698d10d81598534167ea5c6fb7bf3441040aa22a0a57048967
Opcode Fuzzy Hash: 830170af9e05d3dbdbf0f1320e03d58499cc30579d0bb48bb262cb75337020d8
Instruction Fuzzy Hash: F301D8332893215E962427B5BD88BAB2765EB017B9730BA3FF714950F0EF514C03C944

Uniqueness

Uniqueness Score: -1.00%

Function 00416D19 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040E430,?,?,?,0040EB2D,?), ref: 00416D1D
_free.LIBCMT ref: 00416D50
_free.LIBCMT ref: 00416D78
SetLastError.KERNEL32(00000000), ref: 00416D85
SetLastError.KERNEL32(00000000), ref: 00416D91
_abort.LIBCMT ref: 00416D97

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction ID: 67229b3f983384f7021419eb0c05c433d1635833c178197dce61a7b79ae5b6d3
Opcode Fuzzy Hash: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction Fuzzy Hash: E1F0A931784B1026C61177367C09BDF27295FC1765B27092FF518A2291EE7CDCC6815D

Uniqueness

Uniqueness Score: -1.00%

Function 02EE6F80 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02EDE697,?,?,?,02EDED94,?), ref: 02EE6F84
_free.LIBCMT ref: 02EE6FB7
_free.LIBCMT ref: 02EE6FDF
SetLastError.KERNEL32(00000000), ref: 02EE6FEC
SetLastError.KERNEL32(00000000), ref: 02EE6FF8
_abort.LIBCMT ref: 02EE6FFE

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction ID: d8b5f894ab45cb9dfe9e8a99298a304287fecb433906f73dd2fbe7f42b9d7eb4
Opcode Fuzzy Hash: f96bdeef7c0e3eccb1d63bd3d789de4010dedbd7b57bf7c614ef8227c1c7df8a
Instruction Fuzzy Hash: 94F02D716C45112BCF213B766C08F5F361E9BD1735F25E434F527D2190EF608806C926

Uniqueness

Uniqueness Score: -1.00%

Function 02ED37D6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED37DB

Strings

Installed, xrefs: 02ED37E4
185.172.128.228, xrefs: 02ED37E2
/ping.php?substr=%s, xrefs: 02ED37E3
qvB, xrefs: 02ED37D6

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed$qvB
API String ID: 3519838083-3387484886
Opcode ID: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction ID: 4ce39ec4d3a4601a0db3db4e3b94b4fb6983a199b264d08ed5037f7ea11d3490
Opcode Fuzzy Hash: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction Fuzzy Hash: 0301C072A81515ABD7049F88DC40BAEB7BAFF44714F10916AF808D7241D3B0AA528EE5

Uniqueness

Uniqueness Score: -1.00%

Function 00417253 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,-@,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue), ref: 00417285
GetLastError.KERNEL32(?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042E2F0,FlsSetValue,00000000,00000364,?,00416DEB), ref: 00417291
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004171FA,-@,00000000,00000000,00000000,?,004174B2,00000006,FlsSetValue,0042E2F0,FlsSetValue,00000000), ref: 0041729F

Strings

-@, xrefs: 0041727C

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: -@
API String ID: 3177248105-2564449678
Opcode ID: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction ID: 4020431c692cdd365c1edb7e0a14a8f9a79106a1dcbffcc21bafc0d3a38fe4c7
Opcode Fuzzy Hash: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction Fuzzy Hash: 3A012B3674A6229BC7314B699C449DB7BB8AF457B07110676F90AD7240CB38D847C6EC

Uniqueness

Uniqueness Score: -1.00%

Function 004260E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 00426131
WriteFile.KERNEL32(00000000,?,00000400,AWB,00000000), ref: 00426149
CloseHandle.KERNEL32(00000000), ref: 00426152

Strings

AWB, xrefs: 0042613E, 00426141
/syncUpd.exe, xrefs: 004260EC

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: /syncUpd.exe$AWB
API String ID: 1065093856-3279009668
Opcode ID: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction ID: ea454d58db3f570a703faf9f62bcad87da157c20184f63e0e300e902c8c0e078
Opcode Fuzzy Hash: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction Fuzzy Hash: D5F0F9B2301631BBD72416A6AC49E6BBB5DEF447A4F41003AF705D3292DA75FC1582AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

ios_base::failbit set, xrefs: 0040189B, 004018D2
ios_base::badbit set, xrefs: 00401890, 004018B1
ios_base::eofbit set, xrefs: 004018A0

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction ID: e5a36d636a31146743a29846f322d727076c10bf51cb576a0d0ebd87300f877c
Opcode Fuzzy Hash: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction Fuzzy Hash: 54F0AFA290035C63DB10B9659802BEA7B989F09358F24803BFD45761E1DA795A04C6ED

Uniqueness

Uniqueness Score: -1.00%

Function 02ED1AE6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 02ED1B30
std::system_error::system_error.LIBCPMT ref: 02ED1B3F

Strings

ios_base::eofbit set, xrefs: 02ED1B07
ios_base::badbit set, xrefs: 02ED1AF7, 02ED1B18
ios_base::failbit set, xrefs: 02ED1B02, 02ED1B39

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction ID: 2fcc24a3159aa69a217c1bc953c3b76a172b18fa4d73d36af6f945034d9ec451
Opcode Fuzzy Hash: e60b9ed89db90c4e39532bb7c6aaac4610bd40bec14260a39e28585c0d896fd8
Instruction Fuzzy Hash: 75F0F6B198432CB3CB10A6949C50FE97B999F08390F10E025FD4C6F180E7B55A01C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 00413A6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002), ref: 00413A8C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00413A9F
FreeLibrary.KERNEL32(00000000,?,?,?,00413A1D,00000003,?,004139BD,00000003,00437D60,0000000C,00413B14,00000003,00000002,00000000), ref: 00413AC2

Strings

mscoree.dll, xrefs: 00413A85
CorExitProcess, xrefs: 00413A97

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9ab9df708068ff77d02737265f27547bccff245a6d09e8574e118d44c2a6cbc
Instruction ID: 7ce0cb3fbee047f4a8559af6233cdb304d6a34e640ed2fcc4eaf65fddaef0d9f
Opcode Fuzzy Hash: e9ab9df708068ff77d02737265f27547bccff245a6d09e8574e118d44c2a6cbc
Instruction Fuzzy Hash: F0F04431A01118BBDB119F94DC09BDEBFB8EF44752F5540AAF809A2290DF785E85CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A950 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction ID: 6ea283d57a609fffab434fde2135b7d270b6c6f02c2325d1109ee2994591e76b
Opcode Fuzzy Hash: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction Fuzzy Hash: AE7129719062969BCB308F94C844AFFBB76FF41360F14022BE91457280D778ACE1C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 02EEABB7 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction ID: 16adad05522490a024fdd120a3b1f1c1349e8268cda6fdf72f1f3e235fe2dcb3
Opcode Fuzzy Hash: 40cab8f7c20ceae8ae22ba04d2332552c3c05e9d299873fb0615aa8a463a3c1a
Instruction Fuzzy Hash: 43719231A802169BCF219F94C884AFFBB75EF42359F14E23DE85267350DB708985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004145CC Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417A45: HeapAlloc.KERNEL32(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

_free.LIBCMT ref: 004146D7
_free.LIBCMT ref: 004146EE
_free.LIBCMT ref: 0041470D
_free.LIBCMT ref: 00414728
_free.LIBCMT ref: 0041473F

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 7e145fb4ba94dc3237958cad872b9e908e7f7c9f1f6bf31c302f80a0328396d6
Instruction ID: 1364ae8c8bed3babfbeb70cadbec98ce06422c2098a54f189f7d31eb1db71690
Opcode Fuzzy Hash: 7e145fb4ba94dc3237958cad872b9e908e7f7c9f1f6bf31c302f80a0328396d6
Instruction Fuzzy Hash: 7251E571A00304AFDB20DF65D881BAA77F5EF99728F14056EE809D7690E739ED81CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02EE4833 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02EE7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02EE7CDE

_free.LIBCMT ref: 02EE493E
_free.LIBCMT ref: 02EE4955
_free.LIBCMT ref: 02EE4974
_free.LIBCMT ref: 02EE498F
_free.LIBCMT ref: 02EE49A6

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: d20824fdcacda83af1664dbc103671d64a4d903058c6e02df8cb7ef10616926c
Instruction ID: d140feb5472b2f11ca77445329f883993024cad2bc73091d4047bb2fbf28b93d
Opcode Fuzzy Hash: d20824fdcacda83af1664dbc103671d64a4d903058c6e02df8cb7ef10616926c
Instruction Fuzzy Hash: 9051C231A40205AFDF209F69CC80B6A77F5FF58728B149569E90AE7290E731EA01CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00415063 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004150D5
_free.LIBCMT ref: 004150F5

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction ID: 8cf76a1bb0839b7cd8128bcbec6e1cebe900e569fbfc9cf9c78d37498cff2dcd
Opcode Fuzzy Hash: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction Fuzzy Hash: B241E032E00700EBCB15DFB9C880ADEB7B5EF89314B1185AAE515EB382D734AD41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02EE52CA Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02EE533C
_free.LIBCMT ref: 02EE535C

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction ID: e827ae4bc09a3164f7d78b218acaa0e068a43bb06e16a111fbd25b2be128df63
Opcode Fuzzy Hash: 57661e68e417e5a0554fbeacdd405e98a6be487f0d2ab815210d62823c981124
Instruction Fuzzy Hash: A341D336A403009FCF14DF78C880A5DB3B6EF85318F5595A9E916EB395DB71AD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0041B300 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0041197C,?,00000000,?,00000001,?,?,00000001,0041197C,?), ref: 0041B34D
__alloca_probe_16.LIBCMT ref: 0041B385
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0041B3D6
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00410DD1,?), ref: 0041B3E8
__freea.LIBCMT ref: 0041B3F1

Part of subcall function 00417A45: HeapAlloc.KERNEL32(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 23a3252cb5aa1ceb9cf1dbfe047612e0e4775c8e4192d68e8df02371e9c4781d
Instruction ID: 9ad45024e657c6c1581d72c25b5196d30cf145d3c6dba1e906db6810fcdec08f
Opcode Fuzzy Hash: 23a3252cb5aa1ceb9cf1dbfe047612e0e4775c8e4192d68e8df02371e9c4781d
Instruction Fuzzy Hash: 0831CE32A0021AABDB248F65CC41DEF7BA5EF40314B05412EFC14E6291EB39DDA5CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E403 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041E40C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E42F

Part of subcall function 00417A45: HeapAlloc.KERNEL32(00000000,?,00000000,?,0041B3A4,00000000,?,00410DD1,?,00000008,?,0041197C,?,?,?), ref: 00417A77

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0041E455
_free.LIBCMT ref: 0041E468
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041E477

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: d21167a4ec00cfc2ded7cff180726697e6523b003ed2d29391144b3d5a9b389e
Instruction ID: 3801774db5af9eb9c78c35188b4f65337a3fd4a66a09e05ac0132405ac606614
Opcode Fuzzy Hash: d21167a4ec00cfc2ded7cff180726697e6523b003ed2d29391144b3d5a9b389e
Instruction Fuzzy Hash: C70188766022157B27211A775C4CCBF6A6DDEC6FE4315012EBD08C3200DE788C8685BD

Uniqueness

Uniqueness Score: -1.00%

Function 02EEE66A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02EEE673
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02EEE696

Part of subcall function 02EE7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02EE7CDE

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02EEE6BC
_free.LIBCMT ref: 02EEE6CF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02EEE6DE

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d19c47060a10e2cafe652fe0b9a9a3538350b76910d5e87ed89a6a6c5fab3348
Instruction ID: 6b3608affd5c85b61558fb2ddad549fb3b29b083ec6cf9eb6e6bafecb054268d
Opcode Fuzzy Hash: d19c47060a10e2cafe652fe0b9a9a3538350b76910d5e87ed89a6a6c5fab3348
Instruction Fuzzy Hash: E90124B27422127B2B3026B65C8CC7F7A2DDAC2AF8309513DBD06C6101DF608C0681B8

Uniqueness

Uniqueness Score: -1.00%

Function 00416D9D Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00412386,004170A0,?,00416D47,00000001,00000364,?,0040E430,?,?,?,0040EB2D,?), ref: 00416DA2
_free.LIBCMT ref: 00416DD7
_free.LIBCMT ref: 00416DFE
SetLastError.KERNEL32(00000000), ref: 00416E0B
SetLastError.KERNEL32(00000000), ref: 00416E14

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction ID: 590f77e2bb6cf6723b3ae76f6f4a9e52eee2512f3abf58083b79aa59d1bf9a60
Opcode Fuzzy Hash: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction Fuzzy Hash: 540149363847202B82213676BC45EEB26299BC1374723057FF419A22C2EF7CCC96802C

Uniqueness

Uniqueness Score: -1.00%

Function 02EE7004 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,02EE25ED,02EE7307,?,02EE6FAE,00000001,00000364,?,02EDE697,?,?,?,02EDED94,?), ref: 02EE7009
_free.LIBCMT ref: 02EE703E
_free.LIBCMT ref: 02EE7065
SetLastError.KERNEL32(00000000), ref: 02EE7072
SetLastError.KERNEL32(00000000), ref: 02EE707B

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction ID: 52d265c31924b13319bb9d4594fd1a6fd25e76c7db76f2ffc6aac67cbbfeec80
Opcode Fuzzy Hash: 35a4c01cadca9632a23be7e2e88a6bdbc5a2c1ace872e4e8adc61478f88df720
Instruction Fuzzy Hash: D501F9762C0A012BCF3277755C84F5FA61FABC1374721B438F527A2190FF74880A8965

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED6E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED86

Part of subcall function 0041629A: HeapFree.KERNEL32(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 0041ED98
_free.LIBCMT ref: 0041EDAA
_free.LIBCMT ref: 0041EDBC
_free.LIBCMT ref: 0041EDCE

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e1b2229c170471cad9511440fdbaceac99caba8a87cda5d123aefe47b03668a4
Instruction ID: 4fbf26fd28a8761b677517a124a66282875c94d9b9982584bfc58ae744149868
Opcode Fuzzy Hash: e1b2229c170471cad9511440fdbaceac99caba8a87cda5d123aefe47b03668a4
Instruction Fuzzy Hash: 5FF06232504312EB9E20EF6AF885DDB73E9BA44714355085BF808E7640C778FCC0865C

Uniqueness

Uniqueness Score: -1.00%

Function 004152B2 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004152D0

Part of subcall function 0041629A: HeapFree.KERNEL32(00000000,00000000,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?), ref: 004162B0
Part of subcall function 0041629A: GetLastError.KERNEL32(?,?,0041F021,?,00000000,?,00000000,?,0041F2C5,?,00000007,?,?,0041F6B9,?,?), ref: 004162C2

_free.LIBCMT ref: 004152E2
_free.LIBCMT ref: 004152F5
_free.LIBCMT ref: 00415306
_free.LIBCMT ref: 00415317

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction ID: bd3368c0b25b78dbdc1e8abc7373622524bfd2772586a7011706bfb0bee2724c
Opcode Fuzzy Hash: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction Fuzzy Hash: F3F030B14813208B8A167F16FC415C93B61BB5871931131AFF44956775CB395CA18F8E

Uniqueness

Uniqueness Score: -1.00%

Function 02EE5519 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02EE5537

Part of subcall function 02EE6501: HeapFree.KERNEL32(00000000,00000000,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?), ref: 02EE6517
Part of subcall function 02EE6501: GetLastError.KERNEL32(?,?,02EEF288,?,00000000,?,00000000,?,02EEF52C,?,00000007,?,?,02EEF920,?,?), ref: 02EE6529

_free.LIBCMT ref: 02EE5549
_free.LIBCMT ref: 02EE555C
_free.LIBCMT ref: 02EE556D
_free.LIBCMT ref: 02EE557E

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction ID: 4bdba6c950ba4575c7195c391d70b7fb63bddfcccfc9316b04deed2b5e5cab36
Opcode Fuzzy Hash: d2475394655229b87a2a231197a96fb4321ea4f7fd90eb8942919d33dec51e29
Instruction Fuzzy Hash: EFF0BEB09902208BCE226F18FC844553B67BB14720311752EF0464237CCF364AA98FCF

Uniqueness

Uniqueness Score: -1.00%

Function 0041608E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 0041618D

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2895899722
Opcode ID: eb037faffcbc25224f47b7b172a94a6fa64205ec3c2df8c7b30cae185e3ce1b9
Instruction ID: c5d623140409e6a8d976750a690e768927eb9a43711eccc58faa8c11c80da68b
Opcode Fuzzy Hash: eb037faffcbc25224f47b7b172a94a6fa64205ec3c2df8c7b30cae185e3ce1b9
Instruction Fuzzy Hash: C851E1B1D40209ABDB10AFA9C845EEF7BB8AF45314F16015BE804B7292D77CD981CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004132C3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe,00000104), ref: 00413303
_free.LIBCMT ref: 004133CE
_free.LIBCMT ref: 004133D8

Strings

C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe, xrefs: 004132FA, 00413301, 00413330, 00413368

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe
API String ID: 2506810119-1046901381
Opcode ID: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction ID: 1d3d6450662fa2269543f68f0355dd37071cdd96c53fcda0561707c64ab2d40b
Opcode Fuzzy Hash: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction Fuzzy Hash: 4731B371A40218AFCB21DF9A9C819DEBBB8EB84311B1040ABFC14D7210DB788B81CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 02EE352A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe,00000104), ref: 02EE356A
_free.LIBCMT ref: 02EE3635
_free.LIBCMT ref: 02EE363F

Strings

C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe, xrefs: 02EE3561, 02EE3568, 02EE3597, 02EE35CF

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Pictures\XEAazEoSTmJSOa66cXm6S07v.exe
API String ID: 2506810119-1046901381
Opcode ID: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction ID: 8ec4e7c52d8c0915f38afc3de87e9b1da72a16943a5569189f5a595652bb25f4
Opcode Fuzzy Hash: 7cde11c0b341d83a689c8ac0215e926d985f9273aa0b89270843955781aff3fc
Instruction Fuzzy Hash: 773182B1A80258AFDF21DF999C849AEBBFDEB84714F1090A6E40697310DB708A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02ED374A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED374F

Strings

/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 02ED3757
one, xrefs: 02ED3758
qvB, xrefs: 02ED374A

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one$qvB
API String ID: 3519838083-855906859
Opcode ID: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction ID: ad02dca9dcea92bc89fb72e46ded64b78a61fcdd4b3303bd9e38b3cf21719b52
Opcode Fuzzy Hash: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction Fuzzy Hash: 6D110472A40514BBDB049F88CC40BEEB7BEFF44724F00916AF808D7241D371AA528FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040356F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403574

Strings

Installed, xrefs: 0040357D
/ping.php?substr=%s, xrefs: 0040357C
185.172.128.228, xrefs: 0040357B

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed
API String ID: 3519838083-3380671521
Opcode ID: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction ID: e528e6f54f7bd6397a7a31987af09de96e2bb5ca05102ccdf4d55b1b8520bb33
Opcode Fuzzy Hash: dbdcc093d5ff49b9939fbe79e5565d2d08c15c449c4736c25c3cf056a1d98fb5
Instruction Fuzzy Hash: 2301C472A01114BBDB04AF899C41BAEF76DEF85315F10013FF405E3292D3789E5186E9

Uniqueness

Uniqueness Score: -1.00%

Function 02EF634E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 02EF6398
WriteFile.KERNEL32(00000000,?,00000400,02EF59A8,00000000), ref: 02EF63B0
CloseHandle.KERNEL32(00000000), ref: 02EF63B9

Strings

/syncUpd.exe, xrefs: 02EF6353

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: /syncUpd.exe
API String ID: 1065093856-1956333723
Opcode ID: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction ID: 5d607ecfc7567128f1ebe597e529a3989bdf32e69c1acc5ef529c19896fa98e5
Opcode Fuzzy Hash: a912db88f114df2c6673003673c4522d4d60e875e8989093ee3ec27779da3b73
Instruction Fuzzy Hash: E8F0F4B2342221B7D7301AA99C88E5FBA9DEF846A4F005039F726D3191CBB1EC0486F4

Uniqueness

Uniqueness Score: -1.00%

Function 004261D1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,serversystemNCQ_x64.exe), ref: 00426207
WriteFile.KERNEL32(00000000,?,00000400,00425B7F,00000000), ref: 0042621F
CloseHandle.KERNEL32(00000000), ref: 00426228

Strings

serversystemNCQ_x64.exe, xrefs: 004261D5, 004261F6

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: serversystemNCQ_x64.exe
API String ID: 1065093856-4105491473
Opcode ID: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction ID: e17ace126460657e3681985d0a65b8929ef4349a74fc66e1559dc9d9555c5b24
Opcode Fuzzy Hash: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction Fuzzy Hash: A7F0F6B2701231BBD3305AA6AC48E6BBA5DFF44664F41003ABB01D3150CBB5EC11D2F8

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6438 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,serversystemNCQ_x64.exe), ref: 02EF646E
WriteFile.KERNEL32(00000000,?,00000400,02EF5DE6,00000000), ref: 02EF6486
CloseHandle.KERNEL32(00000000), ref: 02EF648F

Strings

serversystemNCQ_x64.exe, xrefs: 02EF643C, 02EF645D

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: serversystemNCQ_x64.exe
API String ID: 1065093856-4105491473
Opcode ID: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction ID: 16b5ccc2bb3a6dff7e4881301f187ed688ed4d5f993a600d7091d1da0dde450f
Opcode Fuzzy Hash: 81eeccf449e78c501f1cd1432d73a9a3a23dd028abcdb10082ca37ec707300bb
Instruction Fuzzy Hash: C5F096B2741221BBD7305AA69C48F5BBA5DFF44568F008035B719D3154DB71EC05D6F4

Uniqueness

Uniqueness Score: -1.00%

Function 0042615F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExA.SHELL32(?,/BroomSetup.exe), ref: 004261A1
WaitForSingleObject.KERNEL32(?,00008000), ref: 004261B5
CloseHandle.KERNEL32(?), ref: 004261BE

Strings

/BroomSetup.exe, xrefs: 0042616A

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: /BroomSetup.exe
API String ID: 3837156514-1897133622
Opcode ID: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction ID: 1e311514b9377177f2af020c61367fd92aa00ac37d84a7ed16a1071a1e85f590
Opcode Fuzzy Hash: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction Fuzzy Hash: F9018F71E00218EBDF15DF69EC455DDBBB8FF08310F41812AF801A6260EB709A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D6F Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00417DFA
__alldvrm.LIBCMT ref: 00417FFB
__alldvrm.LIBCMT ref: 0041801D

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction ID: 904abf3455293af5dc28361a3842bc8dfa3977a77267bab69feed652e5be58e7
Opcode Fuzzy Hash: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction Fuzzy Hash: 17A11272A083869FDB218E18C881BEBBBF1EF55354F1441AEE5859B281D63C8982C758

Uniqueness

Uniqueness Score: -1.00%

Function 02EE7FD6 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 02EE8061
__alldvrm.LIBCMT ref: 02EE8262
__alldvrm.LIBCMT ref: 02EE8284

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction ID: 7a75555fcf6f4a84602408ccfa02a06db16c6882d842fcf7e9c678d4c7976a03
Opcode Fuzzy Hash: 189549fbd5bb4ab0b5dc2d1a196f9afd79985f6d04f47c2d3181048c17836110
Instruction Fuzzy Hash: C7A19E719807869FEF15CF58C8907AEBBE1EF15354F14D2ADE9869B2A0C3348D41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0042286F Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042299E

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 924813c39a5b03831233b14b3106f787ad6322a7f0d6cd44e75183d026feff34
Instruction ID: 73bae74a26b7ada03dc8fd491e978b67bd9d17df28ded5f6e3a1200ab970dd08
Opcode Fuzzy Hash: 924813c39a5b03831233b14b3106f787ad6322a7f0d6cd44e75183d026feff34
Instruction Fuzzy Hash: 2F411BB1B002207BDB206B7A9D41BEE36A4FF05374F54021BF818D6291DAFC89C19669

Uniqueness

Uniqueness Score: -1.00%

Function 02EF2AD6 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02EF2C05

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3b94825b8aa3832d3ef3165fe941ff5e47c4270fc62a832450709df6769c8b69
Instruction ID: 38cb1b0fd046c624684e22f3effc748779363c8bd9306621a368d1edcc558e14
Opcode Fuzzy Hash: 3b94825b8aa3832d3ef3165fe941ff5e47c4270fc62a832450709df6769c8b69
Instruction Fuzzy Hash: 0D416831AC02056BCF616FB88CA4AFE3BAAEF01334F00E215FF1DD6190DB3485418A62

Uniqueness

Uniqueness Score: -1.00%

Function 02EEB567 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,0042D740,00000000,00000000,8B56FF8B,02EE4002,?,00000004,00000001,0042D740,0000007F,?,8B56FF8B,00000001), ref: 02EEB5B4
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 02EEB63D
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 02EEB64F
__freea.LIBCMT ref: 02EEB658

Part of subcall function 02EE7CAC: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02EE7CDE

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 85e830a01370505c20d0c66bcccfbbe4c72d0f29140b44b833c745a57283bd6b
Instruction ID: d1b85bce522c27373968fc92a10220dd1e5e3d7e766f0250a9e3961f6f2c915b
Opcode Fuzzy Hash: 85e830a01370505c20d0c66bcccfbbe4c72d0f29140b44b833c745a57283bd6b
Instruction Fuzzy Hash: 9431CEB2A0120AABDF248F64DC44DAE7BA6EB40718F05812DFD19DA150EB35C865CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCA4 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0040CCBE

Part of subcall function 0040CC0B: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0040CC3A
Part of subcall function 0040CC0B: ___AdjustPointer.LIBCMT ref: 0040CC55

_UnwindNestedFrames.LIBCMT ref: 0040CCD3
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0040CCE4
CallCatchBlock.LIBVCRUNTIME ref: 0040CD0C

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: 6cd8a4fdf9e309ef40a66346d060796d29459ceaa081db5c793327cde4683266
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: AA012D72500108BBDF116F96CC81DEB3F69EF98758F044129FE0866261C73AE861DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02EDCF0B Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 02EDCF25

Part of subcall function 02EDCE72: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 02EDCEA1
Part of subcall function 02EDCE72: ___AdjustPointer.LIBCMT ref: 02EDCEBC

_UnwindNestedFrames.LIBCMT ref: 02EDCF3A
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 02EDCF4B
CallCatchBlock.LIBVCRUNTIME ref: 02EDCF73

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: 0ea2c8ee5ae4b58e4e2739d85e426b209b9a8b576d40e758f1bcb3563b250468
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: 42014C72140108BBCF126F96CC40EEB7F6AEF88794F15A015FE0896120D732E862DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EE74BA Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,02EDED94,00000000,00000000,?,02EE7461,02EDED94,00000000,00000000,00000000,?,02EE7719,00000006,0042E2F8), ref: 02EE74EC
GetLastError.KERNEL32(?,02EE7461,02EDED94,00000000,00000000,00000000,?,02EE7719,00000006,0042E2F8,0042E2F0,0042E2F8,00000000,00000364,?,02EE7052), ref: 02EE74F8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,02EE7461,02EDED94,00000000,00000000,00000000,?,02EE7719,00000006,0042E2F8,0042E2F0,0042E2F8,00000000), ref: 02EE7506

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction ID: a9d54575486c93b536a909be91023237140a4bdb25b7baff6476fe031d3a3e65
Opcode Fuzzy Hash: ca8a45eebd2a79313c9465f68ee09d2646c408a2010e3a78c504b4db5e2a09bb
Instruction Fuzzy Hash: C20120327927226BCF314B78AC44A97B759AF057A57519934FA07D3140DB20D409C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004129CD

Strings

pow, xrefs: 004129A5, 004129C2

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ba6df8563b8339eb0810a3e9ef2dc3b9b5ce058691c0daabc23001b6b9fc0b5a
Instruction ID: e871ad958d0c3237763a2db945e0d8ca842ad08ee161d37671be5f50051c649b
Opcode Fuzzy Hash: ba6df8563b8339eb0810a3e9ef2dc3b9b5ce058691c0daabc23001b6b9fc0b5a
Instruction Fuzzy Hash: 5C515BB1B5420296C7257719DF813EB2B90EF40750F60496BE085C63E9EB7C8CE6DA4E

Uniqueness

Uniqueness Score: -1.00%

Function 02EF649C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02EF64A1

Part of subcall function 02ED4073: __EH_prolog.LIBCMT ref: 02ED4078
Part of subcall function 02ED4073: std::locale::_Init.LIBCPMT ref: 02ED409A

_Deallocate.LIBCONCRT ref: 02EF65F5

Strings

LyB, xrefs: 02EF649C

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog$DeallocateInitstd::locale::_
String ID: LyB
API String ID: 2389838984-3773714357
Opcode ID: b43d6b7ceb65bfdddc8a4d1d72d1a4e11e7704bb8849fddb18eadf6b27138a00
Instruction ID: 8a10be05a8f80f64bb325f73e5a4620946858cd3405a1673271cc664ca3fa2c8
Opcode Fuzzy Hash: b43d6b7ceb65bfdddc8a4d1d72d1a4e11e7704bb8849fddb18eadf6b27138a00
Instruction Fuzzy Hash: 4B51AD71A40248DFDB04DFA9C890AEDFBB5FF58304F64922EE506A7242D7709A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0041DDFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0041DE21

Strings

.A, xrefs: 0041DE13
, xrefs: 0041DE66

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: Info
String ID: $.A
API String ID: 1807457897-2696116503
Opcode ID: 02f55ba3ac5568e03e9fdbd7b88b41772807cc386f704f7c8a9efdfd3a48f4bf
Instruction ID: c8879a2e2c6f1093175ecb34d3b29c7df1a6cb98fe180daaeb3bdf81d7a36b90
Opcode Fuzzy Hash: 02f55ba3ac5568e03e9fdbd7b88b41772807cc386f704f7c8a9efdfd3a48f4bf
Instruction Fuzzy Hash: 56410AF190434C9ADB218E248D84BFABBB9DF55304F1404EEE58A97142D23DAA86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02EDCA17 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 02EDCA4A
__IsNonwritableInCurrentImage.LIBCMT ref: 02EDCB03

Strings

csm, xrefs: 02EDCAED

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction ID: 3b85d4b0f553489863dbf5c4533aa78a7b8476beb971ae567e65040ced76eeb1
Opcode Fuzzy Hash: 796a0128d9dbb3bf8459a97561fbccceb7ea0ac6e0ba9330f3f48fee75113795
Instruction Fuzzy Hash: C341A130A402199BCF10DF68C880AAEBBB5EF45368F24E157E916AB291D771D947CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 0041FE6D

Strings

ACP, xrefs: 0041FDB0
OCP, xrefs: 0041FDE6

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction ID: 649476e1b3bbd5175eaef6faf82ab2916ec2ed690aaaaf30446e18060a09e767
Opcode Fuzzy Hash: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction Fuzzy Hash: 6D21F772B04201A6DB308E55D901BE772A69B60B24F568077E90AC7312FB3ADDCA835C

Uniqueness

Uniqueness Score: -1.00%

Function 02EEFFF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 02EF00D4

Strings

OCP, xrefs: 02EF004D
ACP, xrefs: 02EF0017

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction ID: 36bca515f3927749d779a2d17ea0de0c2fa4e339cd04ac5959902d4ea66133d6
Opcode Fuzzy Hash: c6d2c2c3f7c25fabefd8c517707ca918c95a0ca72f85b56e9eba91488959f309
Instruction Fuzzy Hash: DD21CB62B81104A6DBB48F54C901B97B266AF40B59F86DC35EB0AD790EFB36DD40C354

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6266 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02EF626B

Strings

Installed, xrefs: 02EF6275, 02EF62A3, 02EF62C2, 02EF62C3
SOFTWARE\BroomCleaner, xrefs: 02EF6273, 02EF6286

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 3519838083-529226407
Opcode ID: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction ID: 1c3277785c2cdcd24bf8127671885ea2ffc62aeb5c016c94c6990ff4565fc372
Opcode Fuzzy Hash: 0c1498eeef2a83cafb83bf210d5a9b90b4b671d1f7746b808874f939b35d2cd9
Instruction Fuzzy Hash: FD31A971A40229EFDB158FA8CC90AFEBB79FB48318F04A12DE902B3251C7710D06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02EF60F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02EF60FE

Part of subcall function 02ED1E19: __EH_prolog.LIBCMT ref: 02ED1E1E

Part of subcall function 02ED266A: __EH_prolog.LIBCMT ref: 02ED266F

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 02EF61E0

Strings

xB, xrefs: 02EF60F9

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID: xB
API String ID: 420165198-2600814558
Opcode ID: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction ID: 75bcab3cca3742e4cb9037d03d7da9f3f2a1d922c25466c01cd01d728b6abc7e
Opcode Fuzzy Hash: 9ab3aaf70d2163a1063e646c5f49d5cb4be0b6ea4cdc2725c479562135cb88ac
Instruction Fuzzy Hash: C531F6B4D41219EBDB14EF94D980AEDF7B5FF48300F10D1AAE815A3640EB746A09CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02ED33DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED33E1
std::locale::_Init.LIBCPMT ref: 02ED3428

Part of subcall function 02ED7FDA: __EH_prolog3.LIBCMT ref: 02ED7FE1
Part of subcall function 02ED7FDA: std::_Lockit::_Lockit.LIBCPMT ref: 02ED7FEC
Part of subcall function 02ED7FDA: std::locale::_Setgloballocale.LIBCPMT ref: 02ED8007
Part of subcall function 02ED7FDA: _Yarn.LIBCPMT ref: 02ED801D
Part of subcall function 02ED7FDA: std::_Lockit::~_Lockit.LIBCPMT ref: 02ED805D

Part of subcall function 02ED3651: __EH_prolog.LIBCMT ref: 02ED3656
Part of subcall function 02ED3651: std::_Lockit::_Lockit.LIBCPMT ref: 02ED3665
Part of subcall function 02ED3651: int.LIBCPMT ref: 02ED367C
Part of subcall function 02ED3651: std::locale::_Getfacet.LIBCPMT ref: 02ED3685
Part of subcall function 02ED3651: std::_Lockit::~_Lockit.LIBCPMT ref: 02ED36CC

Part of subcall function 02ED1AE6: __CxxThrowException@8.LIBVCRUNTIME ref: 02ED1B30
Part of subcall function 02ED1AE6: std::system_error::system_error.LIBCPMT ref: 02ED1B3F

Strings

!vB, xrefs: 02ED33DC

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$std::locale::_$H_prologLockit::_Lockit::~_$Exception@8GetfacetH_prolog3InitSetgloballocaleThrowYarnstd::system_error::system_error
String ID: !vB
API String ID: 372095707-662244105
Opcode ID: 4deb0b62ca6bed2fa6a44367b456c2ab057c0f4f5e284071d2ebbd93a586d0bc
Instruction ID: eb2a181099f8e0ed6cc3f541d9d0c5d2a3085b300a32d6e607fedae8f1e4da21
Opcode Fuzzy Hash: 4deb0b62ca6bed2fa6a44367b456c2ab057c0f4f5e284071d2ebbd93a586d0bc
Instruction Fuzzy Hash: 5A2164B1A00A0AAFD714DF2AC185A99FBF1FB08314F50926EE01997A80D774E965CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004171B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00417217
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00417224

Strings

-@, xrefs: 004171EE, 00417202, 004171F3

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: -@
API String ID: 2279764990-2564449678
Opcode ID: dc50904c779d9d650c94e7699dac49ecaf35141d5acdb291f08ec5f954601914
Instruction ID: be5354ef9640d5baeda707f88ba0ee7c606e7dd11eb492dad25bcfdc379f5c6d
Opcode Fuzzy Hash: dc50904c779d9d650c94e7699dac49ecaf35141d5acdb291f08ec5f954601914
Instruction Fuzzy Hash: E7110633A04120ABAB369E19EC809DB73B9AB843207164272FD15AB344DB34DCC2C6D9

Uniqueness

Uniqueness Score: -1.00%

Function 004034E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004034E8

Strings

one, xrefs: 004034F1
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 004034F0

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one
API String ID: 3519838083-2876206925
Opcode ID: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction ID: 23fc970319ec432bccea8ea3542248735fa0f2929cdefa52ec0488ef77b85577
Opcode Fuzzy Hash: f5393bbe0179e56c72e8d6aed76511a95c4a66d15052c3b77f8b18530fd2a227
Instruction Fuzzy Hash: BD11C232A00014BBDB04AF899C01BAEBB69EF45315F40012FF405A3292D3799A518BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402FE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402FEA
std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00407D73: __EH_prolog3.LIBCMT ref: 00407D7A
Part of subcall function 00407D73: std::_Lockit::_Lockit.LIBCPMT ref: 00407D85
Part of subcall function 00407D73: std::locale::_Setgloballocale.LIBCPMT ref: 00407DA0
Part of subcall function 00407D73: _Yarn.LIBCPMT ref: 00407DB6
Part of subcall function 00407D73: std::_Lockit::~_Lockit.LIBCPMT ref: 00407DF6

Strings

T*@, xrefs: 00402FFA

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prologH_prolog3InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: T*@
API String ID: 4198646248-2370032326
Opcode ID: fa242de69d7e6d687caa4bf5b119ee0c34448b06913b79c6670ede3c9bbc00ff
Instruction ID: c469f1781f4eb74895915257e237cd09ecdba2ecacf51dc6ab7e16c1717fddcf
Opcode Fuzzy Hash: fa242de69d7e6d687caa4bf5b119ee0c34448b06913b79c6670ede3c9bbc00ff
Instruction Fuzzy Hash: F921B0B5A00A06AFC305DF6AD581995FBF8FF49314B40822FE80987B50E774A964CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040436E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404373

Part of subcall function 00403A42: __EH_prolog.LIBCMT ref: 00403A47

__Getcoll.LIBCPMT ref: 004043CF

Strings

u@@, xrefs: 004043C9

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: H_prolog$Getcoll
String ID: u@@
API String ID: 206117190-736001340
Opcode ID: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction ID: 22f8a194e856adbcf5db44b98b1892bbe0116132472f20e5c64479f843611134
Opcode Fuzzy Hash: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction Fuzzy Hash: 511170B19012099FCB04EFA9C581A9DBBB4FF84308F10843FE545BB281D7789A44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02ED45D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED45DA

Part of subcall function 02ED3CA9: __EH_prolog.LIBCMT ref: 02ED3CAE

__Getcoll.LIBCPMT ref: 02ED4636

Strings

cwB, xrefs: 02ED45D5

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog$Getcoll
String ID: cwB
API String ID: 206117190-1299997670
Opcode ID: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction ID: e07eae84378096e10216d331d90b86ac0429f1b9822bf793aafd2b80957089ab
Opcode Fuzzy Hash: 8ac08cb90d6c8a0e3a8eafc8112a944c2dcf30f0700bdbfcd0b9c4691759611c
Instruction Fuzzy Hash: 37115AB29402099FCB00EFA8D480ADDB7B5FF54714F10D46AE01AAB240D770AA46CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02ED1A6D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02ED1A72

Strings

ios_base::failbit set, xrefs: 02ED1A82
?uB, xrefs: 02ED1A6D

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: ?uB$ios_base::failbit set
API String ID: 3519838083-946796157
Opcode ID: 234de090022dfe67052ebfa9b3a4f165bdb172cecaf10e59d262a8163687a49b
Instruction ID: 179010d23342a5e286c324401904a93876e9dba2847e087f9af888083d206a13
Opcode Fuzzy Hash: 234de090022dfe67052ebfa9b3a4f165bdb172cecaf10e59d262a8163687a49b
Instruction Fuzzy Hash: 5401DF72900109AFDB04EF98C480BFDFBB9EF49314F18905EE805AB251D7B45E46CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02EF63C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00008000), ref: 02EF641C
CloseHandle.KERNEL32(?), ref: 02EF6425

Strings

/BroomSetup.exe, xrefs: 02EF63D1

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: CloseHandleObjectSingleWait
String ID: /BroomSetup.exe
API String ID: 528846559-1897133622
Opcode ID: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction ID: 7034252c36634f9055eb2fc39abad344ae1775ea799a6d3c25063777f7d4a5ba
Opcode Fuzzy Hash: faa3531e92f7a28ce8b89843f4620ca73c62c6e16bba268bd3709f44c3ecf90f
Instruction Fuzzy Hash: 0B017C31D01218EBDB15DF69E8445DCBBB8FF48714F40C12AF912A6260EB709645CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6D4 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 0041A76A
GetLastError.KERNEL32 ref: 0041A778
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0041A7D3

Memory Dump Source

Source File: 0000000F.00000002.3312675882.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 796b5502bf3758a62d3774a2a03d829f786e940855c074945e7165fbf0666ef5
Instruction ID: 87839b596d2bb0c5de59c8c1227ac8d795198cb32e80a538f680ccd386729a76
Opcode Fuzzy Hash: 796b5502bf3758a62d3774a2a03d829f786e940855c074945e7165fbf0666ef5
Instruction Fuzzy Hash: 04410830602246AFCF219F69C944AEF7BB4AF01310F15416AEC6997291DB38CDA2C75A

Uniqueness

Uniqueness Score: -1.00%

Function 02EEA93B Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 02EEA9D1
GetLastError.KERNEL32 ref: 02EEA9DF
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 02EEAA3A

Memory Dump Source

Source File: 0000000F.00000002.3368165895.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed0000_XEAazEoSTmJSOa66cXm6S07v.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e2dcd7916019b3a733183e7ba2e3bccfca86bceaf396c0a8a97430b0cc35b528
Instruction ID: 974ae95ce485046cb0502074aa199239bb2a48f29d52239403a26b9558f23caf
Opcode Fuzzy Hash: e2dcd7916019b3a733183e7ba2e3bccfca86bceaf396c0a8a97430b0cc35b528
Instruction Fuzzy Hash: 2C41C030640306AFCF218F64D944BAA7BA5AF41328F15E17DF95EAB3A0DB318905CB64

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wjaGPzkDQjpdcbjBR9AwSFKW.exePID: 8044, Parent PID: 7520COMMON

Executed Functions

Function 00414B04 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00414B2A

Part of subcall function 004159F8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
Part of subcall function 004159F8: HeapDestroy.KERNEL32 ref: 00415A48

GetCommandLineA.KERNEL32 ref: 00414B8A
GetStartupInfoA.KERNEL32(?), ref: 00414BB5
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414BD8

Part of subcall function 00414C31: ExitProcess.KERNEL32 ref: 00414C4E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction ID: b13fe99396feb2249fb7197ea22bdd2eb3a8d4431b5d50e9622b99800ed9eeb5
Opcode Fuzzy Hash: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction Fuzzy Hash: 0721D2B0A44705AFD718AFB6DC46BEE7BB8EF44714F10052FF9009A291DB3C85808A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004055DE Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004055E3

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileW.KERNELBASE(?,?), ref: 00405611
AreFileApisANSI.KERNEL32(?), ref: 0040563D
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040565E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileFind$First$ApisCloseH_prolog
String ID:
API String ID: 4121580741-0
Opcode ID: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction ID: 53571c6d670a3437f98eaf3b47711b77fa147e423a783867877babb07b55427d
Opcode Fuzzy Hash: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction Fuzzy Hash: AB21813180050ADFCF11EF60C8459EEBB75EF00329F10476AE4A5B61E1DB399A85CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040553A Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction ID: 4d0f5172a85985fc9641596f45f8b0e99eb03685ed3a07152804d04183bf4296
Opcode Fuzzy Hash: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction Fuzzy Hash: 5DE0923040050876CB20BF35DC019EB776AEF11398F104276F955672E5D738D9468F98

Uniqueness

Uniqueness Score: -1.00%

Function 00401014 Relevance: 56.7, APIs: 12, Strings: 20, Instructions: 692
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A51: GetVersionExA.KERNEL32(?), ref: 00401A6B

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038EE: __EH_prolog.LIBCMT ref: 004038F3

Part of subcall function 004045E2: __EH_prolog.LIBCMT ref: 004045E7
Part of subcall function 004045E2: GetModuleFileNameW.KERNEL32(?,?,00000105,00000003,00000000,00000000), ref: 00404618

Part of subcall function 0040235E: __EH_prolog.LIBCMT ref: 00402363

Part of subcall function 00402323: __EH_prolog.LIBCMT ref: 00402328

Part of subcall function 00403D5A: __EH_prolog.LIBCMT ref: 00403D5F

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DF
SetCurrentDirectoryA.KERNELBASE(?,?,00000001,?,?,00000003,00000003,0042023C,;!@InstallEnd@!,?,00000003,00000000,00000002,00420274,00000003,?), ref: 0040161E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401627
ShellExecuteExA.SHELL32(0000003C,?,00000000), ref: 004016D7
MessageBoxW.USER32(00000000,?,?,00000024), ref: 00401306

Part of subcall function 00411093: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0041109C

Part of subcall function 00402F15: __EH_prolog.LIBCMT ref: 00402F1A

SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018B2
CloseHandle.KERNEL32(?,?,00000000), ref: 00401940
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00401965
CloseHandle.KERNEL32(?,?,00000000), ref: 0040196E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401977

Strings

Directory, xrefs: 004012A9
ExecuteFile, xrefs: 004013DD
D, xrefs: 00401821
Can not load codecs, xrefs: 0040152A
Can not open file, xrefs: 004016EB
Can not create temp folder archive, xrefs: 004014DC
, xrefs: 004016DD
Can't load config info, xrefs: 0040118B
;!@Install@!UTF-8!, xrefs: 00401178
Config failed, xrefs: 004011FE
<, xrefs: 0040166B
RunProgram, xrefs: 0040139D
Title, xrefs: 00401212
ExecuteParameters, xrefs: 0040141D
%%T\, xrefs: 0040179E
;!@InstallEnd@!, xrefs: 00401173
> @, xrefs: 004011DC
setup.exe, xrefs: 00401731
Can not find setup.exe, xrefs: 00401776
%%T, xrefs: 004017CD

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog$CurrentDirectory$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$> @$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 2760820266-829806607
Opcode ID: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction ID: 30a6e78c0a87ce65c61bf6c489231b06ab30573cf11c386798d37ebdc1e5dfdc
Opcode Fuzzy Hash: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction Fuzzy Hash: 57524971D002199ADF21EFA1DC85AEEBB75BF04318F1040BFE149761A2DB395A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD19 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AD1E

Part of subcall function 0040D7CC: __EH_prolog.LIBCMT ref: 0040D7D1

Part of subcall function 00413310: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041333E

DeleteCriticalSection.KERNEL32(?), ref: 0040AF52
DeleteCriticalSection.KERNEL32(?), ref: 0040B1DF
DeleteCriticalSection.KERNEL32(?), ref: 0040B24A
DeleteCriticalSection.KERNEL32(?), ref: 0040B2A7
DeleteCriticalSection.KERNEL32(?), ref: 0040B3B6
DeleteCriticalSection.KERNEL32(?), ref: 0040B410
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B485
DeleteCriticalSection.KERNEL32(?), ref: 0040B517

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction ID: 06aa0bffc57edc8446930be4fb3d3ecc4288fdccd94c57135405988f21593cb0
Opcode Fuzzy Hash: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction Fuzzy Hash: 5D625E7090024ADFDB14DFA4C944BDDBBB4EF14308F1480AEE815B72D2DB789A49DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004059B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004059B8
AreFileApisANSI.KERNEL32(?,?,00000000,00000003,?,00000000,?,00000000), ref: 004059DC

Part of subcall function 0040597A: CreateFileA.KERNEL32(?,00000001,?,00000000,?,?,00000000,?,KA,00405A0D,?,?,?,KA,?,00000001), ref: 0040599C

CreateFileW.KERNELBASE(?,?,?,00000000,KA,?,00000000,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A41

Strings

KA, xrefs: 00405A34, 004059FE

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: File$Create$ApisH_prolog
String ID: KA
API String ID: 1948390111-4133974868
Opcode ID: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction ID: 6ceee1153368ae3910bf8b124445a1a72b78f4c7609cf7ab69cd6f34e54ac91e
Opcode Fuzzy Hash: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction Fuzzy Hash: E0118E72A00109EFCF01AFA4D8818DE7F76EF08318F10412AF512B21A1CB398A65DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00408524 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408529

Strings

Unknown error, xrefs: 004087EA, 004087EF
83B, xrefs: 0040881D

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID: 83B$Unknown error
API String ID: 3519838083-1944086607
Opcode ID: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction ID: d43b38567734cbd3d280cef04a8de17ccbe463ec1fdb7709e9180388f705ec22
Opcode Fuzzy Hash: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction Fuzzy Hash: A5D17070900259EFCF05DFA4C944ADEBB74BF14318F20846EF845BB291CB78AA45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00408F0A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408F0F
GetLastError.KERNEL32(?,00000003,00000003,00000003,?,?,00000000), ref: 00408FD3

Part of subcall function 00409184: __EH_prolog.LIBCMT ref: 00409189

Part of subcall function 004092E9: __EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00408A3B: __EH_prolog.LIBCMT ref: 00408A40

Strings

KA, xrefs: 00409089

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID: KA
API String ID: 2901101390-4133974868
Opcode ID: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction ID: 1ffdda1e280707f1620b0bff2a1c5a648dc862d45b7bd7d33f28712355ced64d
Opcode Fuzzy Hash: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction Fuzzy Hash: 7C81677190020AABCF01EFA5C885ADEBBB5BF18318F14416EF455B32A2CB399A05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004049DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004049E2
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00404A6D

Strings

KA, xrefs: 004049F6, 00404A56, 00404B4E, 00404B7E, 00404A7A, 00404B84

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: KA
API String ID: 1057991267-4133974868
Opcode ID: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction ID: ea88e0dbf276ed2b61ac96949af9a946984d9cda694903235269fb2a0f105987
Opcode Fuzzy Hash: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction Fuzzy Hash: 14512671A4010A9ACF10EBA0C945AFFBB74EF91318F14017BE601732D1D779AE46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401AF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00401AF9

Strings

KA, xrefs: 00401BF0, 00401BF7
KA, xrefs: 00401B4E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID: KA$KA
API String ID: 3519838083-594506476
Opcode ID: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction ID: 3866b3b7da3d7396f9922ec017f7e66c93d936b9f161a27d318f0a0663603341
Opcode Fuzzy Hash: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction Fuzzy Hash: 7451CF72D042199FDF11DFA4C940BEEBBB4AF05394F14416AE851732E2E3789E85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD8B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040DD90

Strings

, xrefs: 0040DE57

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction ID: cf89379ab294d4739916b9706e3dd1d7b183837ff3903d8a06049ba810aa014c
Opcode Fuzzy Hash: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction Fuzzy Hash: 19515E71E006069BDB14DFA9C881ABFB7B5EF98304F14853AE405BB381D778A9458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403113 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403118

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004049DD: __EH_prolog.LIBCMT ref: 004049E2

Part of subcall function 00409569: __EH_prolog.LIBCMT ref: 0040956E

Strings

Default, xrefs: 0040322A

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction ID: 6c236086827897a16f525891fa60e3e62c5941a793998487ad20a929e2e28791
Opcode Fuzzy Hash: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction Fuzzy Hash: 76516071900609EFCB10EFA5D8859EEBBB8FF08318F00456FE45277291DB38AA05CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00402F15 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402F1A

Part of subcall function 00403376: __EH_prolog.LIBCMT ref: 0040337B

Part of subcall function 004034E3: __EH_prolog.LIBCMT ref: 004034E8

Part of subcall function 0040309D: __EH_prolog.LIBCMT ref: 004030A2
Part of subcall function 0040309D: ShowWindow.USER32(00414BE4,00000001,000001F4,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004030FB

Part of subcall function 004131E0: CloseHandle.KERNEL32(00000000,00000000,00403035,?,?,00000000,00000003,?,00000000,?,?,00000000,00000000,00000000), ref: 004131EA
Part of subcall function 004131E0: GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004131F4

Strings

KA, xrefs: 00403042

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID: KA
API String ID: 2740091781-4133974868
Opcode ID: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction ID: b66072ba2aa71961cefff889ac2f3310996ab01b533407b8592e0c78779ee57e
Opcode Fuzzy Hash: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction Fuzzy Hash: 2F41AF31900249DBCB11EFA5C991AEDBBB8AF14314F1480BFE906B72D2DB385B45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00408902 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408907
GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00408AEB,?,?,?,?,?,?,?,00000000), ref: 00408994

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction ID: a8fc1237ba57e47b0ed65f04e9c7bd5e3c99de29461016f9efabf40ab0132a5b
Opcode Fuzzy Hash: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction Fuzzy Hash: 3F3181B19012499FCB10DF95CA859BEBBA0FF04314B14817FE495B72A1CB388D41CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051C8 Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004051CD

Part of subcall function 0040511B: __EH_prolog.LIBCMT ref: 00405120

Part of subcall function 004058CD: __EH_prolog.LIBCMT ref: 004058D2

GetLastError.KERNEL32(?,?,?,?,00000003,?,00000000,?,00000000), ref: 0040522C

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID:
API String ID: 2901101390-0
Opcode ID: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction ID: 4ca71d6396368880cce983a38ddafe9bc91d36a7a330c4fa26da9ce64be84c4d
Opcode Fuzzy Hash: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction Fuzzy Hash: 43114831C00A059ACF14FBA5D4426EFBB70DF51368F1042BFA462771E28B7C1A4ACE19

Uniqueness

Uniqueness Score: -1.00%

Function 004159F8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09

Part of subcall function 004158B0: GetVersionExA.KERNEL32 ref: 004158CF

HeapDestroy.KERNEL32 ref: 00415A48

Part of subcall function 00415A55: HeapAlloc.KERNEL32(00000000,00000140,00415A31,000003F8), ref: 00415A62

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction ID: d610f17f35f819288534aaa08ec9d41b03b5a17a7fe04688d897b1e7918b3c37
Opcode Fuzzy Hash: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction Fuzzy Hash: 00F03070696A01EBDB206B715DCA7E62A949F84799F104637F540C85A0EB7884C19A1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405ACE Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00405AE9
GetLastError.KERNEL32(?,?,?,?), ref: 00405AF7

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction ID: ae3098a1e04470c1e0e5e0b92581544958da7485e9b3b22056b888074196ff7d
Opcode Fuzzy Hash: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction Fuzzy Hash: 89F0B7B4504208EFCB14CF54D9448AE7BF9EF49350B108169F815A7390D731AE00DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBC9 Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BBCE

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction ID: 754c2283aee26f26976a66738bb4ef570e525f81dc1fbbef9a6f78583ad2e2a8
Opcode Fuzzy Hash: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction Fuzzy Hash: 5B325D70904249DFDB10DFA8C584ADEBBB4AF58304F1441AEE855BB3C2CB78AE45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040280D Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402812

Part of subcall function 00402D80: EnterCriticalSection.KERNEL32(?,?,?,004095B9), ref: 00402D85
Part of subcall function 00402D80: LeaveCriticalSection.KERNEL32(?,?,?,?,004095B9), ref: 00402D8F

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction ID: 6b86c84e82b28a82bfdc9d9b9477fa58d6923614df4f06b31c284573bb568367
Opcode Fuzzy Hash: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction Fuzzy Hash: 14F1AD30900249DFCF14EFA5C989ADEBBB4AF54318F14806EE445B72E2DB789A45CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00408A3B Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408A40

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction ID: 34c7193a5b50bb33ce0ba2a09d23f7b106f418ab12413814a78bbf0ce5505d58
Opcode Fuzzy Hash: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction Fuzzy Hash: 62E17F70A00249DFCF10DFA4C988AAEBBB4AF58314F2445AEE495F72D1CB389E45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0B Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EA10

Part of subcall function 0040FA43: __EH_prolog.LIBCMT ref: 0040FA48

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d5330e640343d25a8eedcdb33eba9a98cecc4117f45ccf2878744254283c26ce
Instruction ID: 11288496f406677f7bdfcb919023cacd5b8123072d96ac47e6bfd322b071945c
Opcode Fuzzy Hash: d5330e640343d25a8eedcdb33eba9a98cecc4117f45ccf2878744254283c26ce
Instruction Fuzzy Hash: 38C14770910269DFDB10DFA5C884BDDBBB4BF14308F1080AEE915B72C2CB786A49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F648 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1bd80e4fd0229361987f9fd3b275e1f8f365478e336be0a9cb425272782c87b8
Instruction ID: 8e2da863e0ec0aed1c7df7ef9f788bacddda9dad52c8f94b50dff24b72cd6dff
Opcode Fuzzy Hash: 1bd80e4fd0229361987f9fd3b275e1f8f365478e336be0a9cb425272782c87b8
Instruction Fuzzy Hash: A7814A71E006059BCB24EBA9C481ADEFBB0BF48304F14453EE445B3791DB38A949CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFAD Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CFB2

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction ID: 9f9062e63dd4364452e2da1ca70528b8602d2a0ea6fe4ab8d483929f8703c9bd
Opcode Fuzzy Hash: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction Fuzzy Hash: 69518C31C04145DBCB15DFA8C884EAA7B71AF45308F1880BBE4157F2D2DA399A4EDB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C783 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C788

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction ID: af1ffdf326ee6b9e8f9f4efb185a7a75328b0af80e7613720a9e9424578e33b6
Opcode Fuzzy Hash: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction Fuzzy Hash: A9416D71A00646CFCB24DF58C48496ABBF1FF48314B2486AED096AB392C371ED46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1AB Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D1B0

Part of subcall function 0040F8C3: __EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040D2CF: __EH_prolog.LIBCMT ref: 0040D2D4

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction ID: 9d10d91046bd1a4dd32f0e664b06ea8990f5f8cc09720d5c411fd584516079ca
Opcode Fuzzy Hash: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction Fuzzy Hash: 83313031901254DBCB11EFA4C6487EDBBB5AF15304F1440AEE8057B382DB78DE49DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413EA3 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413F8A

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction ID: 7c2cfac85a053aeac9454e1c2b35b253285297f11283e44f43d764ba5cf7311f
Opcode Fuzzy Hash: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction Fuzzy Hash: 1A217431E44605EBDB10AFA9DC42BDAB7B4EB01765F10421BF411EB2D0C778AAC28A58

Uniqueness

Uniqueness Score: -1.00%

Function 00413F9F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074), ref: 00414073

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction ID: 47133188c5d3e4a4a91398ef735a592283a7fe3b34e77d79aa204ad2d485eaa9
Opcode Fuzzy Hash: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction Fuzzy Hash: 8321C572901609EADB20ABA6DC46BDE7B78EF48764F14021BF511B61C0D77C89C18AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A011 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A016

Part of subcall function 00409C49: __EH_prolog.LIBCMT ref: 00409C4E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction ID: 1dffea12e82b47f2a36155f0264cd4dada82ecc0bfe076f3ab6191fd12039e28
Opcode Fuzzy Hash: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction Fuzzy Hash: 4C118FB0A01254DADB09EBAAC5153EDFBA69FA1318F14419FA542732D2CBF81B048666

Uniqueness

Uniqueness Score: -1.00%

Function 004092E9 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00402634: __EH_prolog.LIBCMT ref: 00402639

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction ID: f7fbb3e9a8787d76bf0f9f15101cef5fd9d7ebfa1ebb25f778e30044bb5e9d70
Opcode Fuzzy Hash: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction Fuzzy Hash: 7B01D6766406049ACB10EF25C451ADEBBB1FF95318F00852FE896632E1CB785649CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004048B7 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 004048F1

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog
String ID:
API String ID: 3885834519-0
Opcode ID: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction ID: d8abee0b5bf8aaacd3c7805e8248c04f8c14d25ec22198af343fb12e16f398c4
Opcode Fuzzy Hash: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction Fuzzy Hash: 76E02B66F002502BC7103BA5AC065DB3B9D9B81314B20C43BA602A3291E9388E44A258

Uniqueness

Uniqueness Score: -1.00%

Function 0040499C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000), ref: 004049D0

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040498D: CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CreateDirectory$ApisFileH_prolog
String ID:
API String ID: 1021588753-0
Opcode ID: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction ID: 2f64d7a75cdf7ff6db5ed191fdbb19fa086d8aebc57dacf92a4c812467fb8a6f
Opcode Fuzzy Hash: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction Fuzzy Hash: 18E0DFA0B002002BCB147B79AC0679E376D4B80218F10867EA652671E1EA7999449608

Uniqueness

Uniqueness Score: -1.00%

Function 004050AB Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNELBASE(?,?,00000000,00000003,?,?,00000000,004050FF,?,?,?,00405160,?,?,?,00000003), ref: 004050CE

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction ID: d5c13e583cf4c34c7a3a11816bb62f42e40da82da4d3cfe63a6d47b8b5213b5b
Opcode Fuzzy Hash: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction Fuzzy Hash: 91E086723016106BD71056699C45A4BA7DEDFD8752F15843FB545E3381D6B48C004A78

Uniqueness

Uniqueness Score: -1.00%

Function 00405D59 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405D71

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction ID: d0734d5c7e5939215d37afae748a6b456316f2180b0855a0f59ce99ff0d6cfc1
Opcode Fuzzy Hash: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction Fuzzy Hash: C0E0E572640704A6C7209F65D8559877BE8EF00385B10C43FF548D6150E779E5508BD8

Uniqueness

Uniqueness Score: -1.00%

Function 004058CD Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004058D2

Part of subcall function 00405806: __EH_prolog.LIBCMT ref: 0040580B

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction ID: 5bfd618a99589873673dbdde5608ad138896477ef474a485a6b18cf586c7d2b5
Opcode Fuzzy Hash: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction Fuzzy Hash: E7E01A72D410049ACB05BB95E9526EDB778EF51319F10403BA412725919B785E18CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00405C87 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405CAA

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction ID: 646c0e8b7f70081892c45aa98fa77e415187d9694f298a279afc83584de54578
Opcode Fuzzy Hash: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction Fuzzy Hash: F8E0E575600208FFCB11CF95C801B8E7BF9EB09364F20C069F914AA260D339EA50DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405841 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004055DE: __EH_prolog.LIBCMT ref: 004055E3
Part of subcall function 004055DE: FindFirstFileW.KERNELBASE(?,?), ref: 00405611

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FindH_prolog$CloseFileFirst
String ID:
API String ID: 2004497850-0
Opcode ID: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction ID: b7fde63f1f0c292b4e5d00ec8c3d5d27a79480d2707f186765d0e2b5b752fd38
Opcode Fuzzy Hash: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction Fuzzy Hash: 7CE04FB1951506ABCB14DF50CC52AEEB734FB1131CF10421EE021722D08B785648CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00405806 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040580B

Part of subcall function 0040553A: FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Find$CloseFileFirstH_prolog
String ID:
API String ID: 889498515-0
Opcode ID: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction ID: 15a52a3ac40e1f9f01e416ae3406c700f8aec04b6379e90cb97043f6baa550c5
Opcode Fuzzy Hash: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction Fuzzy Hash: 2AE01AB195150AAACB04DB50CC52AEEB760EB1131CF00421AA421722D0877856488A28

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8C3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040F648: __EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction ID: 6b40bdca6a02cd8c303c1b1c800ac92429027f894e9b325ac65d5e69f4ab0667
Opcode Fuzzy Hash: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction Fuzzy Hash: 0CD01272911104EBD711AB49D842BDEBB68EB8135DF10853BF00171550C37D56459569

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405BC6,00000000,?,00000000,?,00405BEC,00000000,?,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction ID: c5e24743f6b433bb21cc94cc2971fe47eb8403274bd7f90fdb54931116458873
Opcode Fuzzy Hash: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction Fuzzy Hash: 7EE0EC75241208FBCB01CF90CD01FCE7BB9EB49754F208058E90596160D375AA14EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040551A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction ID: 986561ebb0227da743eeb2b9ec995cdcc659c9848a972ac8d271436d9e92df52
Opcode Fuzzy Hash: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction Fuzzy Hash: 6BD0123150452166CF745E3C7C459C333D99A123B03660BAAF4B4D32E5D3748CC35AD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405A63 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,00405A2C,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A6E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction ID: 8a38a6d9813b312501c47e0c29c9a2f8cf12ac5fa7676fc4773f80372e0f1af5
Opcode Fuzzy Hash: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction Fuzzy Hash: 5CD0C93160462146CA645E3C7C849D737D89A16330325176AF0B5D22E4D3748D875E94

Uniqueness

Uniqueness Score: -1.00%

Function 00404BDC Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

DeleteFileA.KERNELBASE(?,?,00404DBF,?,00000000,?,?,?,?,?,00000000), ref: 00404BED

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction ID: 9a45e8f854b003a178289988cc7fc064ae5902da4cc88310474d582750e90668
Opcode Fuzzy Hash: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction Fuzzy Hash: 0BC08C26209231439A043ABA3805ACB171E0EC122030AC0BBB800A2059CB288DC221DC

Uniqueness

Uniqueness Score: -1.00%

Function 00405C5A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405C84,00000000,00000000,?,00402E12,?), ref: 00405C68

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction ID: 87fe90df0bd66b56430cb58ce5188ab21e49bedd0782b4bf3c7b48ca6ef22eff
Opcode Fuzzy Hash: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction Fuzzy Hash: 8EC04C36158105FF8F020F70CC04C5EBFA2EB99711F10C918B269C40B0C7328024EB02

Uniqueness

Uniqueness Score: -1.00%

Function 0040489C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction ID: c0231da6564a4fbd22ddd4f059f5cfeb57e5ba4ab4dd36146b68eeddd1056acd
Opcode Fuzzy Hash: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction Fuzzy Hash: 5BA002A03112059BA6145B315E0AB6F296DEDC9AE1705C56C7412C5060EB29C9505565

Uniqueness

Uniqueness Score: -1.00%

Function 0040498D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction ID: 18df801fa9cda183c38834b8287032c54ef98b8f5de1dc60049a64e9909c76fe
Opcode Fuzzy Hash: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction Fuzzy Hash: DCA0223030030283E2200F320E0AB0F280CAF08AC0F00C02C3000C80E0FB28C000008C

Uniqueness

Uniqueness Score: -1.00%

Function 004070AC Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 004070DD

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction ID: e1c64c6d5edf12e6328a1e744b201271d318d100f8e499d88b0975d8390c0fb0
Opcode Fuzzy Hash: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction Fuzzy Hash: AEF0BE32A041849BCF11DFA0C80898A7F61FF55310B0084ABF905A7251C7359C10DF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00417836 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004178A3
GetStdHandle.KERNEL32(000000F4,0041BD2C,00000000,00000000,00000000,?), ref: 00417979
WriteFile.KERNEL32(00000000), ref: 00417980

Strings

X*B, xrefs: 00417844
<program name unknown>, xrefs: 004178B3
..., xrefs: 004178F5
Microsoft Visual C++ Runtime Library, xrefs: 0041794F
*B, xrefs: 00417851
Runtime Error!Program: , xrefs: 00417909

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $X*B$*B
API String ID: 3784150691-2787626558
Opcode ID: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction ID: 83e6cc08efc147308ddc610541e3e7ace00831554afff49654370310fabd765f
Opcode Fuzzy Hash: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction Fuzzy Hash: 6E310472A00218AFEF20E660DD45FDA737DEB45344F5000ABF544D6140EBBCAAC58BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00418320 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041795A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD2C,?,0041BD7C,?,?,?,Runtime Error!Program: ), ref: 00418332
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041834A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041835B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418368

Strings

GetLastActivePopup, xrefs: 0041835D
MessageBoxA, xrefs: 00418344
GetActiveWindow, xrefs: 00418355
user32.dll, xrefs: 0041832D

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction ID: e87ed1bb16eb8be6f8b96595097180185a60ce52c98033cfd4ddfb8cddd90555
Opcode Fuzzy Hash: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction Fuzzy Hash: C50179713002057F87209FB59C80A9B7AF4EB44B45318003EB558C3251DB6DCFC29BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041881D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BDF8,00000001,00000000,00000000,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 0041885F
LCMapStringA.KERNEL32(00000000,00000100,0041BDF4,00000001,00000000,00000000,?,?,004186BE,?,?,?,00000000,00000001), ref: 0041887B
LCMapStringA.KERNEL32(?,?,?,004186BE,?,?,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188C4
MultiByteToWideChar.KERNEL32(?,004256C5,?,004186BE,00000000,00000000,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188FC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,004186BE,?,00000000,?,?,004186BE,?), ref: 00418954
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004186BE,?), ref: 0041896A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004186BE,?), ref: 0041899D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004186BE,?), ref: 00418A05

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction ID: 3960beb12fca16cbc5043acf4b8975ab8d8a6698fa07e30ad5f7fd63c5f4fb56
Opcode Fuzzy Hash: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction Fuzzy Hash: 14517B71900209EFCF228F95CC45AEF7FB5FF48794F10452AF918A1260C7398991DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041750F Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041752A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041753E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041756A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175A2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175C4
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175DD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 004175F0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041762E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction ID: 0d29547afa55ef8e208fbe3ff43deda8167c9cf171b961166aceb77faed46397
Opcode Fuzzy Hash: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction Fuzzy Hash: 4A31ADB250D3157ED7207F799C848FBBABDEA49368B11053BF555C3200EA298DC286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00418A6C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BDF8,00000001,?,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AAB
GetStringTypeA.KERNEL32(00000000,00000001,0041BDF4,00000001,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AC5
GetStringTypeA.KERNEL32(?,?,?,?,004186BE,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AF9
MultiByteToWideChar.KERNEL32(?,004256C5,?,?,00000000,00000000,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418B31
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004186BE,?), ref: 00418B87
GetStringTypeW.KERNEL32(?,?,00000000,004186BE,?,?,?,?,?,?,004186BE,?), ref: 00418B99

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction ID: e288f18e772608454304c6360a88be647065f5ca3cb36798b5d5ed4d75a3f5a0
Opcode Fuzzy Hash: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction Fuzzy Hash: B0416DB2600219BFCF208F94DC86EEF7F79EB08794F10442AF915D2250D7389991CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004158B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004158CF
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00415904
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415964

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041593E
__MSVCRT_HEAP_SELECT, xrefs: 004158FF

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction ID: 007b09a40ac423c1d447adb87a92c2e34be193f5817f586218815b66d4303cb2
Opcode Fuzzy Hash: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction Fuzzy Hash: 403177F1961648EDEF3196709C82BDF3B78DB46324F2400DBD185D6242E6388EC68B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00417641 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041769F
GetFileType.KERNEL32(?,?,00000000), ref: 0041774A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004177AD
GetFileType.KERNEL32(00000000,?,00000000), ref: 004177BB
SetHandleCount.KERNEL32 ref: 004177F2

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction ID: 1521dec5194d53324a877df202082dadc936f581ec6971422c000dc394b087b4
Opcode Fuzzy Hash: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction Fuzzy Hash: 39510B716086458FC7208B28D8847A67BB0FB11378F65866ED5B2C72E0D738A886C759

Uniqueness

Uniqueness Score: -1.00%

Function 00403AA7 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AC2
GetLastError.KERNEL32(?,00000000,00000000,?,00403B6F), ref: 00403ACE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AE9
CharUpperA.USER32(?,?,00000000,00000000,?,00403B6F), ref: 00403B02
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B6F), ref: 00403B15

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction ID: 0842cb939f6927aecb542cd9758d214692c03acffe84293a02396fd76ee0080f
Opcode Fuzzy Hash: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction Fuzzy Hash: B30144B65001197ADB20ABE49CC9DEBBA7CDB08259F414572F942A3281E3756E4487B8

Uniqueness

Uniqueness Score: -1.00%

Function 00415523 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416EEF,00417BBE,00000000,?,?,00000000,00000001), ref: 00415525
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415533
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041557F

Part of subcall function 00416EFC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00416FF2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415557
GetCurrentThreadId.KERNEL32 ref: 00415568

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction ID: cede6b9146d9eee740ee2dfbc4b23865fcca372efd47330e9e203dd76af2c63a
Opcode Fuzzy Hash: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction Fuzzy Hash: 09F09635A01611BBC7312B74AC096DB3E62EB857A1B51413AF551962A4DB28888196EC

Uniqueness

Uniqueness Score: -1.00%

Function 00417E3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00414BA4), ref: 00417E8B

Part of subcall function 0041576B: LeaveCriticalSection.KERNEL32(?,00413F70,00000009,00413F5C,00000000,?,00000000,00000000,00000000), ref: 00415778

Strings

WB, xrefs: 00417EA8
WB, xrefs: 00417EF8
+B, xrefs: 00417E7F

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: +B$WB$WB
API String ID: 1866836854-4076192905
Opcode ID: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction ID: 91cfe2518806d3d9ee68befd2fe7c4d9c34af4d87c59522c175cbc6726151178
Opcode Fuzzy Hash: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction Fuzzy Hash: FC41243164C654AEE720DB24D8853EB7BF1AB05314FB4406BE5488B291CABD49C7C74C

Uniqueness

Uniqueness Score: -1.00%

Function 0041458F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction ID: b0a20c71c01645f6642c62949d543ab21d76ee58160ce25a59b39075e73dd19d
Opcode Fuzzy Hash: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction Fuzzy Hash: 4691E671D01514ABCB21AB69DC85ADEBBB4EFC5764F240227F818B62D0D7398DC1CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041659C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420818,00420818,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165BD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165E1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165FB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?), ref: 004166BC
HeapFree.KERNEL32(00000000,00000000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?,00000000), ref: 004166D3

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction ID: 0af9858cac0a30669fb94f5f64461d90f8de944a7195c69e4f59e8ed45fdce2d
Opcode Fuzzy Hash: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction Fuzzy Hash: 983101B0700705EBD3309F24EC45BA2BBE4EB44794F12823AE55597791E778E8818BCC

Uniqueness

Uniqueness Score: -1.00%

Function 00409787 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040978C

Part of subcall function 004095DD: EnterCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095E2
Part of subcall function 004095DD: LeaveCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095EC

EnterCriticalSection.KERNEL32(?), ref: 004097B9
LeaveCriticalSection.KERNEL32(?), ref: 004097D5
__aulldiv.LIBCMT ref: 00409824

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction ID: 0a470d0c852558693c62499fef9fcf54cb9603282822d0262474d13d459b1607
Opcode Fuzzy Hash: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction Fuzzy Hash: D2316076A00219AFCB10EFA1C881AEFBBB5FF48314F00442EE10573692CB79AD45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004095F7 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413260: SetEvent.KERNEL32(00000000,00407649), ref: 00413263

GetDlgItem.USER32(?,000003E8), ref: 0040961A
LoadIconA.USER32(00000000), ref: 00409634
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00409645
SetTimer.USER32(?,00000003,00000064,00000000), ref: 00409654

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction ID: 551790b6ae67963d7c94afa5d69916b6b09ae611f895d6b9f891aac7cfc7161a
Opcode Fuzzy Hash: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction Fuzzy Hash: AF010830140B00AFD7219B21DD5AB66BBA1BF04721F008B2DE9A7959E0CB76B951CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040483F Relevance: 6.0, APIs: 4, Instructions: 36filetimeCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000078,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040484F
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040486B
SetFileTime.KERNEL32(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000), ref: 00404882
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?), ref: 0040488E

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction ID: 64467d0e5ceda328e6e32eae128236dd02d513a4ef1926b956b8d25c0d97de23
Opcode Fuzzy Hash: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction Fuzzy Hash: B4F0E2762803507BE2302B60AC48F9B6E5CDBC9B25F108535B2A5A20E0C2294D1992B8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D7CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D7D1

Strings

, xrefs: 0040D9B0
, xrefs: 0040D988

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction ID: b608afa5533618173c50a936dd0dc92eebd328cd23ff399218f1dfb4b0bc6294
Opcode Fuzzy Hash: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction Fuzzy Hash: 6A713571E0020A9FCB24DF99D481AAEB7B1FF48314F10457ED416B7691D734AA8ACF54

Uniqueness

Uniqueness Score: -1.00%

Function 00403D5A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403D5F

Part of subcall function 00403F3C: __EH_prolog.LIBCMT ref: 00403F41

Strings

KA, xrefs: 00403DA1, 00403DD1, 00403DA4
> @, xrefs: 00403D6A

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prolog
String ID: > @$KA
API String ID: 3519838083-301980584
Opcode ID: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction ID: 0797aa4f2666763f951e0621ef07ec53320c6840b80f95fc9e8c0876c74f2843
Opcode Fuzzy Hash: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction Fuzzy Hash: 27517D30D0020A9ACF15EF95C855AEEBF7AAF5430AF10452FE452372D2DB795B06CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0041808D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004180A1

Strings

, xrefs: 004180EA
, xrefs: 004180C6

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction ID: d0f9309d8466ab513fef0fe96190925d4c3a9a36aebfd3e00fd14af349a29a6b
Opcode Fuzzy Hash: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction Fuzzy Hash: 18417C322046586EEB22DB14CC4DFFB7FA8DB06700F9400EAD549C7162CA794985CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405F5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F63
LoadStringW.USER32(KA,?,?,00000000), ref: 00405FBC

Strings

KA, xrefs: 00405FB9

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction ID: f8b33de4bb70f64bdff40eb498b0250b344fd9cf2a6d880d3b442eae3703c9f6
Opcode Fuzzy Hash: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction Fuzzy Hash: B8212771D0011A9BCB05EFA1C9919EEBBB5FF08308F10407AE106B6291DB794E40CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405EC1
LoadStringA.USER32(KA,?,?,00000000), ref: 00405F12

Strings

KA, xrefs: 00405F0F

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction ID: 682fdee239e6c4724d42c8af7adc4720fc3e2d38c4520a7b7ac2604701000241
Opcode Fuzzy Hash: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction Fuzzy Hash: 6C1126B1D011199ACB06EFA5C9959EEBBB4FF18304F50447EE445B3291DB7A5E00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004160FA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416122
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416156
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00416170
HeapFree.KERNEL32(00000000,?), ref: 00416187

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction ID: c92a38fae87bb937ac208a7a453d8678043178d73965b4d0b203d58dccefea2c
Opcode Fuzzy Hash: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction Fuzzy Hash: 98112B31300B01BFC7318F29EC869567BB5FB49764791862AF151C65B0C7709842CF48

Uniqueness

Uniqueness Score: -1.00%

Function 004156E1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156EE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156F6
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156FE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 00415706

Memory Dump Source

Source File: 00000016.00000002.3317629153.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.3317547365.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319610212.000000000041B000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319848544.0000000000420000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3319992025.0000000000422000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320051235.0000000000423000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000016.00000002.3320115346.0000000000427000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_wjaGPzkDQjpdcbjBR9AwSFKW.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction ID: 9a5a21d657ffcc76f5c3c67f011d6e28d8344b300781f1748fbef07cd2b7b2eb
Opcode Fuzzy Hash: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction Fuzzy Hash: CCC00231A05138ABCB712B65FC048563FB5EB882A03558077A1045203186612C12EFD8

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_72840a9326b146c8f797fe2c317b7fd81655ef_07b00b77_725b6b51-d5b5-4457-94a8-6a7675320663\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12CF.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F25.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41B2.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD34A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD530.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD58E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5AC.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD61A.tmp.txt

Windows Analysis Report
SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre