Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
Analysis ID:1428462
MD5:193692e1cf957eef7e6cf2f6bc74be86
SHA1:9d1f849b57c96ca71f0f90c73de97fa912b691d7
SHA256:fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
Tags:exe
Infos:

Detection

LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected Glupteba
Yara detected LummaC Stealer
Yara detected Mars stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Stealc
Yara detected Vidar stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds extensions / path to Windows Defender exclusion list (Registry)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates HTML files with .exe extension (expired dropper behavior)
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops PE files to the document folder of the user
Exclude list of file types from scheduled, custom, and real-time scanning
Found API chain indicative of sandbox detection
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found pyInstaller with non standard icon
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Installs new ROOT certificates
LummaC encrypted strings found
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies Group Policy settings
Modifies power options to not sleep / hibernate
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries BIOS fan information (via WMI, Win32_Fan, often done to detect virtual machines)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queries temperature or sensor information (via WMI often done to detect virtual machines)
Queries voltage information (via WMI often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes many files with high entropy
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a Chrome extension
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Windows Defender Exclusions Added - Registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match
query blbeacon for getting browser version

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe (PID: 432 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe" MD5: 193692E1CF957EEF7E6CF2F6BC74BE86)
    • yyfBua979C0ZzSPnCxybIlhk.exe (PID: 6776 cmdline: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe MD5: 12D7B7B63D8EA8B173B69246184905D6)
    • Fb9COhEBuDNRhtMnCgGo2QiL.exe (PID: 4068 cmdline: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe MD5: 15A5A210A88D15A932171A9FA25A1356)
      • MSBuild.exe (PID: 4128 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
    • xNcVS_VvZEHfTUaNtkua55mf.exe (PID: 2140 cmdline: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe MD5: A37AAFD52FA58B0518A5ABFC1126A3BD)
    • DLdiRYbSxUKrp0thTehxs0R7.exe (PID: 368 cmdline: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe MD5: D15459E9B9D12244A57809BC383B2757)
    • OPHZ4RYtForDNHqUKDzFdbyl.exe (PID: 2748 cmdline: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe MD5: 442D026B2FA7E3CEB35BB40D28065A7D)
    • 8q5xyu0coQILTrboZdACo84I.exe (PID: 6768 cmdline: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe MD5: 5E2A97C7C4BDD77D61B82E3C8454C0F1)
    • f5PK0Fmcntr6Bz8d571_sPMM.exe (PID: 2360 cmdline: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe MD5: 8B65C04554FDC08623E5A74F8F9B9FD2)
    • jToGBYVMqv5v7FLLCc3PnzZj.exe (PID: 6540 cmdline: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe MD5: 03DA9FDAF31B27C888D1331D69DC9EF8)
      • is-RKCCV.tmp (PID: 1252 cmdline: "C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp" /SL4 $B0024 "C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe" 3625196 52224 MD5: 823E80C325207F495A59B69AAE8AEFAD)
        • cddvdrunner2333.exe (PID: 3436 cmdline: "C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i MD5: 00B640E64C35C1E3F7AD1CB9A979BF2E)
    • rvzZmTKhzLAk54H0OO5fg4xv.exe (PID: 6204 cmdline: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe MD5: 65BE3195B801D271E01D41F7BF576BD8)
      • schtasks.exe (PID: 6548 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 1288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Hrpxb3VVNyjyS2Of2WrcJREY.exe (PID: 5560 cmdline: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe MD5: 399332B0CAB6E3C41A0AA0ED563BED9B)
    • B0SLNTT0ZbIxZcHr0SHBJGEz.exe (PID: 1976 cmdline: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe MD5: 68B27A8882FFD2A01203CC218BD80849)
      • regsvr32.exe (PID: 5000 cmdline: "C:\Windows\System32\regsvr32.exe" /S .\TaFD.XRA MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • tNKXm3LImvO5in9OelWM8_lp.exe (PID: 1628 cmdline: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe MD5: B6D1F343014DC55EF2588CA861DB518B)
      • conhost.exe (PID: 3424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • RegAsm.exe (PID: 5808 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • wjwNFr_3XWBVO8HOPBPzLGWO.exe (PID: 7060 cmdline: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe MD5: 9C100E7F219C7E05CCEA1899C511F4B9)
      • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
    • GDL7jRat1qTWaJDTi_iESGFr.exe (PID: 1576 cmdline: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe MD5: B091C4848287BE6601D720997394D453)
      • powercfg.exe (PID: 5148 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
        • conhost.exe (PID: 1896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powercfg.exe (PID: 5600 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
        • conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powercfg.exe (PID: 5528 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • powercfg.exe (PID: 3524 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
        • conhost.exe (PID: 2180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • sc.exe (PID: 2296 cmdline: C:\Windows\system32\sc.exe delete "OBGPQMHF" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 2412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • QnkREgWvOVM7UiM40Bqj5sWB.exe (PID: 3292 cmdline: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe MD5: 817C11005CA185252E666C25769A2591)
    • M3c5GcarM7S9e4Fzg9fhkljA.exe (PID: 1272 cmdline: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe MD5: 0BB19EEF181634DC1AEA014783928EFB)
      • conhost.exe (PID: 5528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • conhost.exe (PID: 4760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • RegAsm.exe (PID: 5080 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • azloBsQlDmB56PqIarSd7g7V.exe (PID: 1196 cmdline: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe MD5: 3F9AE180E3D7B62BC7C5DD2CEEC62A56)
      • Conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Honz_MBQI6vCkcbyCN3yB4rh.exe (PID: 5664 cmdline: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe MD5: 5917C8E5A003B2C211150D1F92440F79)
      • conhost.exe (PID: 3924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Honz_MBQI6vCkcbyCN3yB4rh.exe (PID: 2124 cmdline: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe MD5: 5917C8E5A003B2C211150D1F92440F79)
  • svchost.exe (PID: 2352 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 2748 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • Install.exe (PID: 1772 cmdline: .\Install.exe /dlhwdidkpGO "525403" /S MD5: F8EFB05B940B05FC74801B61B3C0F500)
  • svchost.exe (PID: 2020 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6464 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
NameDescriptionAttributionBlogpost URLsLink
GluptebaGlupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: LummaC

{"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop"], "Build id": "DIJQ6z--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://nidoe.org/tmp/index.php", "http://sodez.ru/tmp/index.php", "http://uama.com.ua/tmp/index.php", "http://talesofpirates.net/tmp/index.php"]}

Threatname: RedLine

{"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
    C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
      C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMALWARE_Win_zgRATDetects zgRATditekSHen
        • 0xcb387:$s1: file:///
        • 0xcb297:$s2: {11111-22222-10009-11112}
        • 0xcb317:$s3: {11111-22222-50001-00000}
        • 0xc9fdb:$s4: get_Module
        • 0x41c0ea:$s4: get_Module
        • 0xc2f8e:$s5: Reverse
        • 0x41abeb:$s5: Reverse
        • 0x41ad57:$s6: BlockCopy
        • 0xc0864:$s7: ReadByte
        • 0x40f9a2:$s7: ReadByte
        • 0xcb399:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000016.00000003.2518467991.0000000006B38000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
          00000016.00000003.2518348325.0000000006AC1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
            00000012.00000002.2709843696.0000000002DB0000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
            • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
            00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmpJoeSecurity_GluptebaYara detected GluptebaJoe Security
              00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                Click to see the 22 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                  7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                    7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                      7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                        7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
                        • 0x503c3:$s1: file:///
                        • 0x502fb:$s2: {11111-22222-10009-11112}
                        • 0x50353:$s3: {11111-22222-50001-00000}
                        • 0x4cd4c:$s4: get_Module
                        • 0x47f68:$s5: Reverse
                        • 0x487f0:$s6: BlockCopy
                        • 0x47f50:$s7: ReadByte
                        • 0x503d5:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
                        Click to see the 18 entries

                        Sigma Signatures

                        Change of critical system settings

                        barindex
                        Sigma detected: Disable power options
                        Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe, ParentImage: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe, ParentProcessId: 1576, ParentProcessName: GDL7jRat1qTWaJDTi_iESGFr.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 5148, ProcessName: powercfg.exe

                        System Summary

                        barindex
                        Sigma detected: CurrentVersion Autorun Keys Modification
                        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe, ProcessId: 6204, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131
                        Sigma detected: Windows Defender Exclusions Added - Registry
                        Source: Registry Key setAuthor: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, ProcessId: 432, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions
                        Sigma detected: Windows Processes Suspicious Parent Directory
                        Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, ProcessId: 2352, ProcessName: svchost.exe

                        Snort Signatures

                        ⊘No Snort rule has matched

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Antivirus detection for dropped file
                        Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeAvira: detection malicious, Label: TR/AD.Nekark.sbdpe
                        Source: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeAvira: detection malicious, Label: TR/AD.Nekark.sbdpe
                        Found malware configuration
                        Source: 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpMalware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}
                        Source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://nidoe.org/tmp/index.php", "http://sodez.ru/tmp/index.php", "http://uama.com.ua/tmp/index.php", "http://talesofpirates.net/tmp/index.php"]}
                        Source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.raw.unpackMalware Configuration Extractor: RedLine {"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe.3292.20.memstrminMalware Configuration Extractor: LummaC {"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop", "wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "entitlementappwo.shop", "stripmarrystresew.shop"], "Build id": "DIJQ6z--"}
                        Multi AV Scanner detection for dropped file
                        Source: C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exeReversingLabs: Detection: 48%
                        Source: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeReversingLabs: Detection: 87%
                        Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exeReversingLabs: Detection: 33%
                        Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeReversingLabs: Detection: 87%
                        Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exeReversingLabs: Detection: 33%
                        Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeReversingLabs: Detection: 48%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\grabber[1].exeReversingLabs: Detection: 15%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Space1.9_team[1].exeReversingLabs: Detection: 29%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exeReversingLabs: Detection: 87%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exeReversingLabs: Detection: 27%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default12_team[1].exeReversingLabs: Detection: 34%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[1].exeReversingLabs: Detection: 33%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[2].exeReversingLabs: Detection: 33%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exeReversingLabs: Detection: 29%
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeReversingLabs: Detection: 34%
                        Source: C:\Users\user\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\tQYsPom.exeReversingLabs: Detection: 34%
                        Source: C:\Users\user\AppData\Local\Temp\DEC.exeReversingLabs: Detection: 95%
                        Multi AV Scanner detection for submitted file
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeReversingLabs: Detection: 21%
                        Yara detected Glupteba
                        Source: Yara matchFile source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: xNcVS_VvZEHfTUaNtkua55mf.exe PID: 2140, type: MEMORYSTR
                        Machine Learning detection for dropped file
                        Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exeJoe Sandbox ML: detected
                        Sample uses string decryption to hide its real strings
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: wifeplasterbakewis.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: mealplayerpreceodsju.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: bordersoarmanusjuw.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: suitcaseacanehalk.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: absentconvicsjawun.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: pushjellysingeywus.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: economicscreateojsu.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: entitlementappwo.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: stripmarrystresew.shop
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: lid=%s&j=%s&ver=4.0
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: TeslaBrowser/5.5
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: - Screen Resoluton:
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: - Physical Installed Memory:
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: Workgroup: -
                        Source: 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString decryptor: DIJQ6z--
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: INSERT_KEY_HERE
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetProcAddress
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: LoadLibraryA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: lstrcatA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: OpenEventA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateEventA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CloseHandle
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Sleep
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetUserDefaultLangID
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: VirtualAllocExNuma
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: VirtualFree
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetSystemInfo
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: VirtualAlloc
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HeapAlloc
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetComputerNameA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: lstrcpyA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetProcessHeap
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetCurrentProcess
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: lstrlenA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ExitProcess
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GlobalMemoryStatusEx
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetSystemTime
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SystemTimeToFileTime
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: advapi32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: gdi32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: user32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: crypt32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ntdll.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetUserNameA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateDCA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetDeviceCaps
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ReleaseDC
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CryptStringToBinaryA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sscanf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: VMwareVMware
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HAL9TH
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: JohnDoe
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DISPLAY
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %hu/%hu/%hu
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: http://185.172.128.23
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: /f993692117a3fda2.php
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: /8e6d9db21fb63946/
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: default9
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetEnvironmentVariableA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetFileAttributesA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GlobalLock
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HeapFree
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetFileSize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GlobalSize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateToolhelp32Snapshot
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: IsWow64Process
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Process32Next
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetLocalTime
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: FreeLibrary
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetTimeZoneInformation
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetSystemPowerStatus
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetVolumeInformationA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetWindowsDirectoryA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Process32First
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetLocaleInfoA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetUserDefaultLocaleName
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetModuleFileNameA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DeleteFileA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: FindNextFileA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: LocalFree
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: FindClose
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SetEnvironmentVariableA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: LocalAlloc
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetFileSizeEx
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ReadFile
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SetFilePointer
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: WriteFile
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateFileA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: FindFirstFileA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CopyFileA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: VirtualProtect
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetLogicalProcessorInformationEx
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetLastError
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: lstrcpynA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: MultiByteToWideChar
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GlobalFree
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: WideCharToMultiByte
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GlobalAlloc
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: OpenProcess
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: TerminateProcess
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetCurrentProcessId
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: gdiplus.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ole32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: bcrypt.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: wininet.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: shlwapi.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: shell32.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: psapi.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: rstrtmgr.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateCompatibleBitmap
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SelectObject
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BitBlt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DeleteObject
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateCompatibleDC
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipGetImageEncodersSize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipGetImageEncoders
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipCreateBitmapFromHBITMAP
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdiplusStartup
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdiplusShutdown
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipSaveImageToStream
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipDisposeImage
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GdipFree
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetHGlobalFromStream
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CreateStreamOnHGlobal
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CoUninitialize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CoInitialize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CoCreateInstance
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptGenerateSymmetricKey
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptCloseAlgorithmProvider
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptDecrypt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptSetProperty
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptDestroyKey
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: BCryptOpenAlgorithmProvider
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetWindowRect
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetDesktopWindow
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetDC
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CloseWindow
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: wsprintfA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: EnumDisplayDevicesA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetKeyboardLayoutList
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CharToOemW
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: wsprintfW
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RegQueryValueExA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RegEnumKeyExA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RegOpenKeyExA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RegCloseKey
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RegEnumValueA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CryptBinaryToStringA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CryptUnprotectData
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SHGetFolderPathA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ShellExecuteExA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetOpenUrlA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetConnectA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetCloseHandle
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetOpenA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HttpSendRequestA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HttpOpenRequestA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetReadFile
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: InternetCrackUrlA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: StrCmpCA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: StrStrA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: StrCmpCW
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PathMatchSpecA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: GetModuleFileNameExA
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RmStartSession
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RmRegisterResources
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RmGetList
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: RmEndSession
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_open
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_prepare_v2
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_step
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_column_text
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_finalize
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_close
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_column_bytes
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3_column_blob
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: encrypted_key
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PATH
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: C:\ProgramData\nss3.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: NSS_Init
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: NSS_Shutdown
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PK11_GetInternalKeySlot
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PK11_FreeSlot
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PK11_Authenticate
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: PK11SDR_Decrypt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: C:\ProgramData\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT origin_url, username_value, password_value FROM logins
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: browser:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: profile:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: url:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: login:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: password:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Opera
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: OperaGX
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Network
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: cookies
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: .txt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: TRUE
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: FALSE
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: autofill
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT name, value FROM autofill
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: history
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT url FROM urls LIMIT 1000
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: name:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: month:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: year:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: card:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Cookies
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Login Data
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Web Data
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: History
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: logins.json
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: formSubmitURL
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: usernameField
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: encryptedUsername
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: encryptedPassword
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: guid
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT fieldname, value FROM moz_formhistory
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SELECT url FROM moz_places LIMIT 1000
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: cookies.sqlite
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: formhistory.sqlite
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: places.sqlite
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: plugins
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Local Extension Settings
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Sync Extension Settings
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: IndexedDB
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Opera Stable
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Opera GX Stable
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: CURRENT
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: chrome-extension_
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: _0.indexeddb.leveldb
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Local State
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: profiles.ini
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: chrome
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: opera
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: firefox
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: wallets
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %08lX%04lX%lu
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ProductName
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %d/%d/%d %d:%d:%d
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ProcessorNameString
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DisplayName
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DisplayVersion
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Network Info:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - IP: IP?
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Country: ISO?
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: System Summary:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - HWID:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - OS:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Architecture:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - UserName:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Computer Name:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Local Time:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - UTC:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Language:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Keyboards:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Laptop:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Running Path:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - CPU:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Threads:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Cores:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - RAM:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - Display Resolution:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: - GPU:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: User Agents:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Installed Apps:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: All Users:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Current User:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Process List:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: system_info.txt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: freebl3.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: mozglue.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: msvcp140.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: nss3.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: softokn3.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: vcruntime140.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Temp\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: .exe
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: runas
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: open
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: /c start
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %DESKTOP%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %APPDATA%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %LOCALAPPDATA%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %USERPROFILE%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %DOCUMENTS%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %PROGRAMFILES%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %PROGRAMFILES_86%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: %RECENT%
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: *.lnk
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: files
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \discord\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Local Storage\leveldb\CURRENT
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Local Storage\leveldb
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Telegram Desktop\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: key_datas
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: D877F783D5D3EF8C*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: map*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: A7FDF864FBC10B77*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: A92DAA6EA6F891F2*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: F8806DD0C461824F*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Telegram
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: *.tox
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: *.ini
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Password
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: 00000001
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: 00000002
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: 00000003
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: 00000004
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Outlook\accounts.txt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Pidgin
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \.purple\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: accounts.xml
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: dQw4w9WgXcQ
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: token:
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Software\Valve\Steam
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: SteamPath
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \config\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ssfn*
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: config.vdf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DialogConfig.vdf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: DialogConfigOverlay*.vdf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: libraryfolders.vdf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: loginusers.vdf
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Steam\
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: sqlite3.dll
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: browsers
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: done
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: soft
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: \Discord\tokens.txt
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: /c timeout /t 5 & del /f /q "
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: " & del "C:\ProgramData\*.dll"" & exit
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: C:\Windows\system32\cmd.exe
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: https
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Content-Type: multipart/form-data; boundary=----
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: POST
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: HTTP/1.1
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: Content-Disposition: form-data; name="
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: hwid
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: build
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: token
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: file_name
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: file
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: message
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
                        Source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpackString decryptor: screenshot.jpg
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987D9D0 CryptAcquireContextA,GetLastError,7_2_6987D9D0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987DBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,7_2_6987DBB0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987DD20 CryptReleaseContext,7_2_6987DD20
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987DEE0 CryptReleaseContext,7_2_6987DEE0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987DE00 CryptGenRandom,__CxxThrowException@8,7_2_6987DE00
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698A35E0 CryptReleaseContext,7_2_698A35E0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987D7D4 CryptReleaseContext,7_2_6987D7D4
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6987D7F0 CryptReleaseContext,7_2_6987D7F0

                        Bitcoin Miner

                        barindex
                        Yara detected Glupteba
                        Source: Yara matchFile source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: xNcVS_VvZEHfTUaNtkua55mf.exe PID: 2140, type: MEMORYSTR

                        Compliance

                        barindex
                        Detected unpacking (overwrites its own PE header)
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeUnpacked PE file: 44.2.cddvdrunner2333.exe.400000.0.unpack
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                        Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbu source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2671952511.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: BdeHdCfg.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: symsrv.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000C7A000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb;Cn source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.0000000001680000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: r\x86\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2681483906.0000000006373000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Moq.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.PDB source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2586786006.0000000001338000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.0000000001680000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: uic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2586786006.0000000001338000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: BdeHdCfg.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: symsrv.pdbGCTL source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000C7A000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.PDB source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2681483906.0000000006373000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdbSHA256 source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: \??\C:\Windows\mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: EfiGuardDxe.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: dbghelp.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: dbghelp.pdbGCTL source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Loader.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: oj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: BitLockerToGo.pdb source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2495725172.000002D546A80000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000266000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2485404914.000002D546AC0000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2102749607.000002262FB02000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104110962.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104275365.000002262FAAD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104927446.000002262FFEF000.00000004.00000020.00020000.00000000.sdmp, B0SLNTT0ZbIxZcHr0SHBJGEz.exe, 00000010.00000000.2244173110.0000000000312000.00000002.00000001.01000000.0000000E.sdmp, B0SLNTT0ZbIxZcHr0SHBJGEz.exe, 00000010.00000002.2431895922.0000000000312000.00000002.00000001.01000000.0000000E.sdmp
                        Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: yyfBua979C0ZzSPnCxybIlhk.exe, yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000000.2240349104.00000000003F6000.00000080.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589762241.00000000003F6000.00000080.00000001.01000000.0000000A.sdmp
                        Source: Binary string: Moq.pdbSHA256@ source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: \??\C:\Windows\mscorlib.pdbJn source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: changepk.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002247000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: CameraSettingsUIHost.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: BitLockerToGo.pdbGCTL source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2495725172.000002D546A80000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000266000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2485404914.000002D546AC0000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: Downloading symbols for [%s] %ssrv*symsrv*http://https://_bad_pdb_file.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbB# source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Unable to locate the .pdb file in this location source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: The module signature does not match with .pdb signature. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: .pdb.dbg source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: '(EfiGuardDxe.pdbx source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: AppInstallerBackgroundUpdate.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002143000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: change.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: AppInstallerBackgroundUpdate.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002143000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: or you do not have access permission to the .pdb location. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\constructicon\builds\gfx\three\20.10\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: changepk.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002247000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: CameraSettingsUIHost.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004A79000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004C04000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2671952511.0000000005D8A000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: y\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb~~ source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: change.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp

                        Change of critical system settings

                        barindex
                        Adds extensions / path to Windows Defender exclusion list (Registry)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_ExtensionsJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_ExtensionsJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6940
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h7_2_05ABD588
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6939
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h7_2_05AB5565
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h7_2_05ABD480
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6C69
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h7_2_05ABD478
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6C70
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then jmp 05ABD06Ah7_2_05ABCFB8
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then jmp 05ABD06Ah7_2_05ABCFB0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6B60
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6B58
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h7_2_05AB36DC
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h7_2_05ABCED7
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6A48
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 4x nop then mov dword ptr [ebp-14h], 40000003h7_2_05AB6A50

                        Networking

                        barindex
                        System process connects to network (likely due to code injection or exploit)
                        Source: C:\Windows\explorer.exeNetwork Connect: 172.67.196.94 443
                        Source: C:\Windows\explorer.exeNetwork Connect: 186.10.34.51 80
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: wifeplasterbakewis.shop
                        Source: Malware configuration extractorURLs: mealplayerpreceodsju.shop
                        Source: Malware configuration extractorURLs: bordersoarmanusjuw.shop
                        Source: Malware configuration extractorURLs: suitcaseacanehalk.shop
                        Source: Malware configuration extractorURLs: absentconvicsjawun.shop
                        Source: Malware configuration extractorURLs: pushjellysingeywus.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: economicscreateojsu.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: entitlementappwo.shop
                        Source: Malware configuration extractorURLs: stripmarrystresew.shop
                        Source: Malware configuration extractorURLs: https://steamcommunity.com/profiles/76561199673019888
                        Source: Malware configuration extractorURLs: http://nidoe.org/tmp/index.php
                        Source: Malware configuration extractorURLs: http://sodez.ru/tmp/index.php
                        Source: Malware configuration extractorURLs: http://uama.com.ua/tmp/index.php
                        Source: Malware configuration extractorURLs: http://talesofpirates.net/tmp/index.php
                        Source: Malware configuration extractorURLs: 5.42.65.50:33080
                        Creates HTML files with .exe extension (expired dropper behavior)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: f4Y7IGUXRMqOH79zw7TPvsbX.exe.0.dr
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: Gon5N1KYkyaNFzeeJDoj76Fi.exe.0.dr
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0093E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,6_2_0093E220
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.facebook.com (Facebook)
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.twitter.com (Twitter)
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.youtube.com (Youtube)
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://127.0.0.1:
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.203/dl.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.203/dl.php(
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.203/dl.php.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/dacha/rules.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/dacha/rules.exeL
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/dacha/rules.exem
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.253/lumma1504.exe
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.253/lumma1504.exen%$
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/api/flash.php
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/api/flash.php:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/api/flash.phpH
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/api/flash.phpV
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/api/flash.phpr
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/123p.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/123p.exeP
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/123p.exeV
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/123p.exef
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.jpeg
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.jpegF3
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.jpegb3
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.jpeghttp://5.42.66.10/download/page_error.pngC:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.png
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/page_error.png.
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/getimage12.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/getimage12.phpgs
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2169039039.000002262FAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.php$
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.php12.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpings
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpings&
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpingsB
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpom/0/6
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpphp.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/retail.phpv
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/download/th/space.php
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/r
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10/rIMa
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10:80/api/flash.php
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10:80/api/flash.php3
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10:80/api/flash.php51
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000FAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.42.66.10:80/download/page_error.pngZZ
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/IsAliveResponse
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/IsAliveT
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StartResponse
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StartT
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopResponseR
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopT
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ACVC.WPF.Service.WcfT
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://https://_bad_pdb_file.pdb
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ocsp.digicert.com0
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp, OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp, OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2256931870.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2263550394.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139755953.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA00000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA0E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA1D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wikkt.com/forum/index.php
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wikkt.com/forum/index.phpF
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wikkt.com/forum/index.phpa
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108082037.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA3C000.00000004.00000020.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000000.2240084953.0000000000410000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://www.innosetup.com
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2256931870.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2263550394.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org).
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589232742.00000000002FF000.00000002.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2411267986.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2596553439.0000000000D96000.00000040.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2596553439.0000000000D96000.00000040.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.winimage.com/zLibDllDp
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.tiktok.com
                        Source: tNKXm3LImvO5in9OelWM8_lp.exe, 00000011.00000002.2302959218.000000000082D000.00000004.00000001.01000000.00000010.sdmpString found in binary or memory: https://api.ip.sb/ip
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000ED0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.myip.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000ED0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.myip.com/v
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000ED0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.myip.com:443/ows
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aui-cdn.atlassian.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108775259.000002262FA0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108362466.000002262FA0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2116491415.000002262FA0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2113083438.000002262FA0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2113464336.000002262FA0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2111124592.000002262FA0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2121711417.000002262FA0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aui-cdn.atlassia~(
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://baldurgatez.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe;2
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://baldurgatez.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe;2
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2112981350.000002262FA85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA04000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168867567.000002262FA8D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104775379.000002262FA8A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bbuseruploads.s3.amazonaws.com/8b0be658-c958-47a3-96e4-fc8e5fe7c5dc/downloads/dc50f97b-477f-
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org/superworkspacenb/gerge/downloads/grabber.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org/superworkspacenb/gerge/downloads/grabber.exeT
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094479399.000002262F7D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org:80/superworkspacenb/gerge/downloads/grabber.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.574859385.xyz/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2121711417.000002262FA0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.574859385.xyz/525403/setup.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://c.574859385.xyz/6
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://carthewasher.net/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://carthewasher.net/ee45f9fcdced34e0430667992abd2d38/cad54ba5b0142
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103339004.000002262FA57000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103290439.000002262FA56000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7C6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103999098.000002262F9F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://carthewasher.net/ee45f9fcdced34e0430667992abd2d38/cad54ba5b01423b1af8ec10ab5719d97.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ampproject.org
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.cookielaw.org/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.syndication.twimg.com
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.goo
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513459274.0000000003796000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx1:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513596742.0000000003788000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx4
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxR4
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://connect.facebook.net
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d136azpfpnge1l.cloudfront.net/;
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d301sr5gafysq2.cloudfront.net/
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52:~s
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52esI
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/l
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/t
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/~
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52z
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA00000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.vk.com
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513150367.00000000037A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/NavigationTiming/Overview.html#process
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513150367.00000000037A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/NavigationTiming/Overview.html#processing-model
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gigachadfanclub.org/ee45f9fcdced34e0430667992abd2d38/7725eaa6592c80f8124e769b4e8a07f7.exe
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: https://github.com/moq/moq4
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E06000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Mozilla/5.0
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2596553439.0000000000D96000.00000040.00000001.01000000.00000016.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589232742.00000000002FF000.00000002.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2411267986.0000000000E60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/:
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000068A000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52c
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52w
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52c
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/1BV4j7.mp4
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/1BV4j7.mp4s%
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/1pRXr7.txt
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/1pRXr7.txtjs_
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/1tqHh7.mp3
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/P
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/R
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/_F
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru/s
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru:443/1BV4j7.mp4O
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru:443/1pRXr7.txt
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplis.ru:443/1tqHh7.mp3u
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/1nhuM4.js
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/1nhuM4.jsX
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org:443/1nhuM4.js
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://login.microsoftonline.com/crypto/rc4:
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/?act=login
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/?act=logout&hash=df5be74fd1475c23cd&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://management.azure.cominvalid
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://management.chinacloudapi.cnP224
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://management.core.chinacloudapi.cnchacha20poly1305:
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://management.core.usgovcloudapi.netGODEBUG
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://management.usgovcloudapi.nethttps://management.core.windows.net/edwards25519:
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top/2
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top/style/060.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top/style/060.exep/0/6
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top/style/060.exes.top/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top:80/style/060.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meet.crazyfigs.top:80/style/060.exe2$
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://monoblocked.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2113407483.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2110942258.000002262FA82000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2112684823.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108279479.000002262FA62000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108740822.000002262FA82000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA61000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2115459164.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108397207.000002262FA80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://monoblocked.com/525403/setup.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://monoblocked.com/525403/setup.exenet/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://monoblocked.com:80/525403/setup.exen$
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513459274.0000000003796000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://page-error.com
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513150367.00000000037A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://page-error.com/performance/?license=$
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513679922.000000000379A000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513150367.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513596742.0000000003788000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513642281.0000000003790000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://page-error.com/thankyou/?uuid=$
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513255238.0000000003787000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000378A000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513385608.0000000003790000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://page-error.comJ
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://palberryslicker.sbs/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://palberryslicker.sbs/lander/File_294/setup294.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://palberryslicker.sbs/r
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153658618.000002262F7EB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://papi.vk.com/pushsse/ruim
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://payments.google.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://platform.twitter.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://r.mradx.net
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s.ytimg.com
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513255238.0000000003787000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sandbox.google.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://securepubads.g.doubleclick.net
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/base.7c74f023.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/common.1545e5c6.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/fonts_cnt.c7a76efe.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/fonts_utf.7fa94ada.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/ui_common.eebaf9c8.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/uncommon.6d51982c.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/vk_sans_display.5625d45f.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/vk_sans_display_faux.7d208ecb.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/al/vkui.43318ab6.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.89b663a3.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.93b52d88.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/common.a525896b.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/react.759f82b6.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/state-management.c22f9f68.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit-icons.826b9222.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit.07cf1bad.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkcom-kit.fef2a97a.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/chunks/vkui.bce4c996.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/common_web.6a09f0e1.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/common_web.9d09fc5d.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/css_types.1bff1a5b.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/docs.20074c02.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/docs.93c768ea.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/error_monitoring.isolated.3df2967b.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/grip.0b3b493f.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/jobs_devtools_notification.14f96f02.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/likes.20074c02.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/likes.de4f3981.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/page_layout.7b5800c2.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/performance_observers.4d12f60f.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/polyfills.isolated.edaffb7b.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/raven_logger.ea0a2239.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/site_layout.20074c02.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/site_layout.4881c427.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/ui_common.20074c02.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/ui_common.88618847.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/unauthorized.20074c02.css
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/unauthorized.bf4667d7.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://st6-22.vk.com/dist/web/vk_sans_observer.fb28db65.js
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://static.vk.me
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.vk-portal.net
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA00000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sun6-21.userapi.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sun6-21.userapi.com/c236331/u5294803/docs/d24/3cad94b79c70/imgdrive_2_1.bmp?extra=KSt_51f-h8
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7BE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sun6-21.userapi.com/c909328/u5294803/docs/d12/eb1afcc538fd/PL_Clients.bmp?extra=iwYpYeMLSGBx
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sun6-21.userapi.com/p
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000063E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000063E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT%
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpString found in binary or memory: https://t.me/irfail
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpString found in binary or memory: https://t.me/irfailAt
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2514882020.0000000006797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tagmanager.google.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://telegram.org
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ton.twimg.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.googleapis.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/&
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exebe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exes
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2628063256.00000000033B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://urn.to/r/sds_see
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F7CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139755953.000002262FA19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/Security
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/browser_reports?dest=default_reports
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139755953.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurK
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/doc329118071_676580549?hash=pFVdCz3lOS502jpZ4S1mZuaA9EuN2MatBz9F2cxg7Ac&dl=ej7ecTKnt3
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/doc5294803_668512951?hash=uac9wbeb45bZZ2A4Vgx1xpUTavuZvoy56VWHrfJX9iH&dl=BnUuPvvpE2Gl
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139755953.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA19000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153300103.000002262FA1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/doc5294803_668627934?hash=KOcSmbd2hjdTG4DLhdJgoCSrHOpCJeuTNRte86dnj0k&dl=iwW1iFTFzY3z
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139755953.000002262FA19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.com/r
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vk.ru
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2256931870.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2263550394.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/contact/
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2263550394.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/contact/.
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2256931870.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000003.2263550394.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/newsletter/
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103368896.000002262FA12000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.c
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513255238.0000000003787000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierra
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.instagram.com
                        Source: yyfBua979C0ZzSPnCxybIlhk.exeString found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
                        Source: 8q5xyu0coQILTrboZdACo84I.exe, 0000000B.00000003.2643761852.000000002D1E0000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                        Source: 8q5xyu0coQILTrboZdACo84I.exe, 0000000B.00000003.2643761852.000000002D1E0000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
                        Source: 8q5xyu0coQILTrboZdACo84I.exe, 0000000B.00000003.2643761852.000000002D1E0000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpString found in binary or memory: https://www.security.us.panasonic.com
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yastatic.net

                        Key, Mouse, Clipboard, Microphone and Screen Capturing

                        barindex
                        Yara detected SmokeLoader
                        Source: Yara matchFile source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RawInputListener: RegisterRawInputDevices() failed, quitting...memstr_b18b3860-e

                        E-Banking Fraud

                        barindex
                        Yara detected Glupteba
                        Source: Yara matchFile source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: xNcVS_VvZEHfTUaNtkua55mf.exe PID: 2140, type: MEMORYSTR
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\Tmp2BCA.tmpJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\Tmp2BDA.tmpJump to dropped file

                        Spam, unwanted Advertisements and Ransom Demands

                        barindex
                        Writes many files with high entropy
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe entropy: 7.99834341189Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe entropy: 7.99834341189Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe entropy: 7.99641413191Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe entropy: 7.99641413191Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\grabber[1].exe entropy: 7.99564568557Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe entropy: 7.99564568557Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\bynA5XZaUopLU9g6Euj0.exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zip entropy: 7.99782759214Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe entropy: 7.99003010243Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\python38.dll entropy: 7.99191184235Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\_cffi.cp38-win_amd64.pyd entropy: 7.99362866091Jump to dropped file

                        System Summary

                        barindex
                        Malicious sample detected (through community Yara rule)
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                        Source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                        Source: 00000012.00000002.2709843696.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                        Source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                        Source: 00000012.00000002.2710983086.0000000002EA2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                        Source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPEDMatched rule: Detects zgRAT Author: ditekSHen
                        .NET source code contains very large array initializations
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, Strings.csLarge array initialization: Strings: array initializer size 6160
                        PE file contains section with special chars
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Uses powercfg.exe to modify the power settings
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05ABD590 NtUnmapViewOfSection,7_2_05ABD590
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05ABD58B NtUnmapViewOfSection,7_2_05ABD58B
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Windows\System32\GroupPolicy\gpt.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Windows\System32\GroupPolicy\MachineJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Windows\System32\GroupPolicy\UserJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Windows\System32\GroupPolicy\Machine\Registry.polJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Windows\SysWOW64\GroupPolicy\gpt.iniJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0092C4906_2_0092C490
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0092BFC06_2_0092BFC0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0095C8006_2_0095C800
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009918306_2_00991830
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3186E6_2_00C3186E
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340776_2_00C34077
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A1B84F6_2_00A1B84F
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3A1DF6_2_00C3A1DF
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A1D9FE6_2_00A1D9FE
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0096C1606_2_0096C160
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C322E86_2_00C322E8
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3328E6_2_00C3328E
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C34A5A6_2_00C34A5A
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A1A306_2_009A1A30
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A72706_2_009A7270
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0096EB906_2_0096EB90
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A05B906_2_00A05B90
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C32B8B6_2_00C32B8B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A003D06_2_00A003D0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C323606_2_00C32360
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0095FB606_2_0095FB60
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A03B586_2_00A03B58
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0099F3606_2_0099F360
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009364906_2_00936490
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3B49D6_2_00C3B49D
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A16CC56_2_00A16CC5
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009224006_2_00922400
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3242B6_2_00C3242B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A34706_2_009A3470
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00A0959F6_2_00A0959F
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C39D896_2_00C39D89
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C395556_2_00C39555
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3350A6_2_00C3350A
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009906C06_2_009906C0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A3EF06_2_009A3EF0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00938EE06_2_00938EE0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009226006_2_00922600
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009926306_2_00992630
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C35FB76_2_00C35FB7
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A2FE06_2_009A2FE0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C397516_2_00C39751
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6984B6B07_2_6984B6B0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698649707_2_69864970
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69890B897_2_69890B89
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69828B307_2_69828B30
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69864AC07_2_69864AC0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69842D707_2_69842D70
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6989AC297_2_6989AC29
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69874EE07_2_69874EE0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6983A0C07_2_6983A0C0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698763B07_2_698763B0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698823107_2_69882310
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6989A54D7_2_6989A54D
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698645507_2_69864550
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6982C7B07_2_6982C7B0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6982A7E07_2_6982A7E0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698266507_2_69826650
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6989B9647_2_6989B964
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698758D77_2_698758D7
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698758D57_2_698758D5
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698758307_2_69875830
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69899AAB7_2_69899AAB
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69875DD07_2_69875DD0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69895DD27_2_69895DD2
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69863C907_2_69863C90
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69881CA07_2_69881CA0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69899FFC7_2_69899FFC
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6989BFF17_2_6989BFF1
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69875EB97_2_69875EB9
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_69863E507_2_69863E50
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698750507_2_69875050
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698632607_2_69863260
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698752747_2_69875274
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698634607_2_69863460
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A6A9B87_2_01A6A9B8
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A698907_2_01A69890
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A6CA287_2_01A6CA28
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A611207_2_01A61120
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A611107_2_01A61110
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A683687_2_01A68368
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A60D607_2_01A60D60
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A60D707_2_01A60D70
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_01A66F597_2_01A66F59
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05AB00407_2_05AB0040
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05AB31B07_2_05AB31B0
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05AB2E587_2_05AB2E58
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05B90EB37_2_05B90EB3
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05B926F87_2_05B926F8
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05B909307_2_05B90930
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_05B926DC7_2_05B926DC
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: String function: 69889B35 appears 141 times
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: String function: 6988D520 appears 31 times
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: String function: 698890D8 appears 51 times
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: invalid certificate
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Resource name: AUUPG type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: Space1.9_team[1].exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe.0.drStatic PE information: Number of sections : 12 > 10
                        Source: Default12_team[1].exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: Retailer_prog[1].exe.0.drStatic PE information: Number of sections : 14 > 10
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: Number of sections : 15 > 10
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139567155.000002262FC00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7zS.sfx.exe, vs SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000000.2030166989.00007FF77F8DE000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCookComputing.XmlRpcV2.dll8 vs SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2139278820.000002262FE9B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7zS.sfx.exe, vs SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCookComputing.XmlRpcV2.dll8 vs SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                        Source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                        Source: 00000012.00000002.2709843696.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                        Source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                        Source: 00000012.00000002.2710983086.0000000002EA2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                        Source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPEDMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon versionJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon versionJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon versionJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon versionJump to behavior
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Section: ZLIB complexity 0.9997554064239332
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Section: ZLIB complexity 1.000469355620155
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Section: ZLIB complexity 0.9892578125
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Section: ZLIB complexity 0.9994283536585366
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, Strings.csCryptographic APIs: 'CreateDecryptor'
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, e7EuwtGMnIvwifDxGE0.csCryptographic APIs: 'CreateDecryptor'
                        Source: classification engineClassification label: mal100.rans.troj.spyw.evad.winEXE@214/396@0/31
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobeJump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: NULL
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4760:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3424:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeMutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeMutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_12
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2412:120:WilError_03
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2180:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3924:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1288:120:WilError_03
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeFile created: C:\Users\user\AppData\Local\Temp\adobequx8jdqZzTMIJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeFile opened: C:\Windows\system32\3743bfe92965e651c86de88a577beac623f12834a30d8c2ced3f982234136822AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile read: C:\Windows\System32\GroupPolicy\gpt.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589232742.00000000002FF000.00000002.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2411267986.0000000000E60000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589232742.00000000002FF000.00000002.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2411267986.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2596553439.0000000000D96000.00000040.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2596553439.0000000000D96000.00000040.00000001.01000000.00000016.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2072366841.000002262F735000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2072325699.000002262DA29000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2471077165.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2471737073.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2472044878.0000000000F85000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2469332249.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2470572740.0000000000F85000.00000004.00000020.00020000.00000000.sdmp, 8q5xyu0coQILTrboZdACo84I.exe, 0000000B.00000003.2489340445.000000002106E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeReversingLabs: Detection: 21%
                        Source: yyfBua979C0ZzSPnCxybIlhk.exeString found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
                        Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe"
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /S .\TaFD.XRA
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe .\Install.exe /dlhwdidkpGO "525403" /S
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess created: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp "C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp" /SL4 $B0024 "C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe" 3625196 52224
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                        Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                        Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "OBGPQMHF"
                        Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess created: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe "C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvcJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe .\Install.exe /dlhwdidkpGO "525403" /SJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess created: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp "C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp" /SL4 $B0024 "C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe" 3625196 52224
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /S .\TaFD.XRA
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "OBGPQMHF"
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess created: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe "C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Windows\explorer.exeProcess created: unknown unknown
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: gpedit.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: activeds.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: dssec.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: dsuiext.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: framedynos.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: dsrole.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: logoncli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: activeds.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ntdsapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: authz.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: activeds.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: adsldpc.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: adsldpc.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: adsldpc.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: webio.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fhsvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msidle.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fhcfg.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wevtapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: efsutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: netapi32.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncasvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: httpprxp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wpdbusenum.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: portabledeviceapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: portabledeviceconnectapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: rstrtmgr.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: d3d11.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: dxgi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: resourcepolicyclient.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: d3d10warp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: dxcore.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: devobj.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: webio.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection loaded: sxs.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: msimg32.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: msvcr100.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wtsapi32.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: winsta.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: sxs.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: netapi32.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: samcli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: samlib.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: gpedit.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: activeds.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: dssec.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: dsuiext.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: framedynos.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: adsldpc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: dsrole.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: logoncli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ntdsapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: authz.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: webio.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: edputil.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: appresolver.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: slc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: sppc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: acgenral.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: samcli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: msacm32.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: dwmapi.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: winmmbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: winmmbase.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: aclayers.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: sfc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeSection loaded: sfc_os.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: msimg32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: msvcr100.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: wininet.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: rstrtmgr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: wldp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: profapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: urlmon.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: srvcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: netutils.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: dpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: ntmarta.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: mozglue.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: wsock32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: vcruntime140.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: msvcp140.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: vcruntime140.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: propsys.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: linkinfo.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeSection loaded: windowscodecs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: msimg32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: msvcr100.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: winmm.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: powrprof.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: umpdc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wtsapi32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: winsta.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wbemcomn.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: sxs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: amsi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: userenv.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: profapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: version.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wbemcomn.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wbemcomn.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wbemcomn.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeSection loaded: wbemcomn.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: acgenral.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: winmm.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: samcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: msacm32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: version.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: userenv.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: dwmapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: urlmon.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: mpr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: winmmbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: winmmbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: srvcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: netutils.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: aclayers.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: sfc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeSection loaded: sfc_os.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: msimg32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: rstrtmgr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: msvcr100.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: d3d11.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: dxgi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: resourcepolicyclient.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: d3d10warp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: dxcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: ntmarta.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: wininet.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: devobj.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: webio.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: dnsapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: rasadhlp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: fwpuclnt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: schannel.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: mskeyprotect.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: ncryptsslp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: msasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: cryptsp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: rsaenh.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: gpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: vaultcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: wldp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeSection loaded: dpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: rstrtmgr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: d3d11.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: dxgi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: resourcepolicyclient.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: d3d10warp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: dxcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: wininet.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: devobj.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: webio.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: dnsapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: rasadhlp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: fwpuclnt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: schannel.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: mskeyprotect.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ncryptsslp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: msasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: cryptsp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: rsaenh.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: gpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: vaultcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: wldp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ntmarta.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: dpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: windowscodecs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: profapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: urlmon.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: srvcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: netutils.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: propsys.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: edputil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: windows.staterepositoryps.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: appresolver.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: bcp47langs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: slc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: userenv.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: sppc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: onecorecommonproxystub.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSection loaded: onecoreuapcommonproxystub.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: version.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: dxgidebug.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: sfc_os.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: rsaenh.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: dwmapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: riched20.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: usp10.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: msls31.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: windowscodecs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: textshaping.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: textinputframework.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: coreuicomponents.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: coremessaging.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: ntmarta.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: coremessaging.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: wldp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: propsys.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: profapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: edputil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: urlmon.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: srvcli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: netutils.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: windows.staterepositoryps.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: appresolver.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: bcp47langs.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: slc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: userenv.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: sppc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: onecorecommonproxystub.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: onecoreuapcommonproxystub.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: pcacli.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeSection loaded: mpr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSection loaded: msimg32.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSection loaded: msvcr100.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeSection loaded: winmm.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeSection loaded: powrprof.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeSection loaded: umpdc.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: rstrtmgr.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: d3d11.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: dxgi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: resourcepolicyclient.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: d3d10warp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: dxcore.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: wininet.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: devobj.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: webio.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile written: C:\Windows\System32\GroupPolicy\gpt.iniJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpWindow found: window name: TMainForm
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: Image base 0x140000000 > 0x60000000
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic file information: File size 4008384 > 1048576
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: Raw size of .vmp(R is bigger than: 0x100000 < 0x39d000
                        Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbu source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2671952511.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004B48000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: BdeHdCfg.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: symsrv.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000C7A000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb;Cn source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.0000000001680000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: r\x86\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2681483906.0000000006373000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Moq.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.PDB source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2586786006.0000000001338000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.0000000001680000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: uic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2586786006.0000000001338000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: BdeHdCfg.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: symsrv.pdbGCTL source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000C7A000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.PDB source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2681483906.0000000006373000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdbSHA256 source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: \??\C:\Windows\mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: EfiGuardDxe.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: dbghelp.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: dbghelp.pdbGCTL source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Loader.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: oj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: BitLockerToGo.pdb source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2495725172.000002D546A80000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000266000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2485404914.000002D546AC0000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2102749607.000002262FB02000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104110962.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104275365.000002262FAAD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104927446.000002262FFEF000.00000004.00000020.00020000.00000000.sdmp, B0SLNTT0ZbIxZcHr0SHBJGEz.exe, 00000010.00000000.2244173110.0000000000312000.00000002.00000001.01000000.0000000E.sdmp, B0SLNTT0ZbIxZcHr0SHBJGEz.exe, 00000010.00000002.2431895922.0000000000312000.00000002.00000001.01000000.0000000E.sdmp
                        Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: yyfBua979C0ZzSPnCxybIlhk.exe, yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000000.2240349104.00000000003F6000.00000080.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589762241.00000000003F6000.00000080.00000001.01000000.0000000A.sdmp
                        Source: Binary string: Moq.pdbSHA256@ source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: \??\C:\Windows\mscorlib.pdbJn source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: changepk.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002247000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: CameraSettingsUIHost.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: BitLockerToGo.pdbGCTL source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2495725172.000002D546A80000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000266000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000003.2485404914.000002D546AC0000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: Downloading symbols for [%s] %ssrv*symsrv*http://https://_bad_pdb_file.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbB# source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp
                        Source: Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: mscorlib.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: Unable to locate the .pdb file in this location source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: The module signature does not match with .pdb signature. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: .pdb.dbg source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: '(EfiGuardDxe.pdbx source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: AppInstallerBackgroundUpdate.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002143000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: change.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: AppInstallerBackgroundUpdate.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002143000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: or you do not have access permission to the .pdb location. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmp
                        Source: Binary string: c:\constructicon\builds\gfx\three\20.10\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: changepk.pdb source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002247000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: CameraSettingsUIHost.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004A79000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2634159423.0000000004C04000.00000004.00000800.00020000.00000000.sdmp, Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2671952511.0000000005D8A000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: y\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb~~ source: Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2589163280.00000000016F2000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: change.pdbGCTL source: OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002217000.00000004.00000020.00020000.00000000.sdmp

                        Data Obfuscation

                        barindex
                        Detected unpacking (changes PE section rights)
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeUnpacked PE file: 18.2.wjwNFr_3XWBVO8HOPBPzLGWO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeUnpacked PE file: 44.2.cddvdrunner2333.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.rview4:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
                        Detected unpacking (overwrites its own PE header)
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeUnpacked PE file: 44.2.cddvdrunner2333.exe.400000.0.unpack
                        .NET source code contains method to dynamically call methods (often used by packers)
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, e7EuwtGMnIvwifDxGE0.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                        .NET source code contains potential unpacker
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, nbHRr4wrm68DvPGr2G8.cs.Net Code: gIHi6nZTWj
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, nbHRr4wrm68DvPGr2G8.cs.Net Code: H0XvE6l8vb
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe.0.drStatic PE information: 0x81E836EB [Mon Jan 24 10:54:35 2039 UTC]
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00938BB0 LoadLibraryA,GetProcAddress,6_2_00938BB0
                        Source: initial sampleStatic PE information: section where entry point is pointing to: .vmp(R
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeFile created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4004000
                        Source: 7725eaa6592c80f8124e769b4e8a07f7[1].exe.0.drStatic PE information: real checksum: 0x42e5b5 should be: 0x42d3e3
                        Source: setup294[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x21765e
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x6b3228
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe.0.drStatic PE information: real checksum: 0x42e5b5 should be: 0x432f23
                        Source: Fb9COhEBuDNRhtMnCgGo2QiL.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x4a74cf
                        Source: setup[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x6b3228
                        Source: B0SLNTT0ZbIxZcHr0SHBJGEz.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x21765e
                        Source: f5PK0Fmcntr6Bz8d571_sPMM.exe.0.drStatic PE information: real checksum: 0x42e5b5 should be: 0x42d3e3
                        Source: jToGBYVMqv5v7FLLCc3PnzZj.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x3d3d2c
                        Source: 060[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x3d3d2c
                        Source: cad54ba5b01423b1af8ec10ab5719d97[1].exe.0.drStatic PE information: real checksum: 0x42e5b5 should be: 0x432f23
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x644d0
                        Source: tNKXm3LImvO5in9OelWM8_lp.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x899e4
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: _RDATA
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .themida
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeStatic PE information: section name: .vmp(R
                        Source: setup294[1].exe.0.drStatic PE information: section name: .didat
                        Source: B0SLNTT0ZbIxZcHr0SHBJGEz.exe.0.drStatic PE information: section name: .didat
                        Source: setup[1].exe.0.drStatic PE information: section name: .sxdata
                        Source: OPHZ4RYtForDNHqUKDzFdbyl.exe.0.drStatic PE information: section name: .sxdata
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .themida
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Default12_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .themida
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .themida
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Retailer_prog[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .themida
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe.0.drStatic PE information: section name: .vmp(R
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe.0.drStatic PE information: section name: .xdata
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name:
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name: .themida
                        Source: 123p[1].exe.0.drStatic PE information: section name: .00cfg
                        Source: 123p[1].exe.0.drStatic PE information: section name: .text0
                        Source: 123p[1].exe.0.drStatic PE information: section name: .text1
                        Source: 123p[1].exe.0.drStatic PE information: section name: .text2
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .themida
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: Space1.9_team[1].exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .themida
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: azloBsQlDmB56PqIarSd7g7V.exe.0.drStatic PE information: section name: .vmp(R
                        Source: GDL7jRat1qTWaJDTi_iESGFr.exe.0.drStatic PE information: section name: .00cfg
                        Source: GDL7jRat1qTWaJDTi_iESGFr.exe.0.drStatic PE information: section name: .text0
                        Source: GDL7jRat1qTWaJDTi_iESGFr.exe.0.drStatic PE information: section name: .text1
                        Source: GDL7jRat1qTWaJDTi_iESGFr.exe.0.drStatic PE information: section name: .text2
                        Source: grabber[1].exe.0.drStatic PE information: section name: _RDATA
                        Source: Honz_MBQI6vCkcbyCN3yB4rh.exe.0.drStatic PE information: section name: _RDATA
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3A8CC push ebp; mov dword ptr [esp], eax6_2_00E1412D
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3A8CC push edi; mov dword ptr [esp], ebp6_2_00E1416B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3A8CC push 3B40FFB0h; mov dword ptr [esp], ebp6_2_00E141D6
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3A8CC push eax; mov dword ptr [esp], edi6_2_00E141EB
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push 7FB76899h; mov dword ptr [esp], esp6_2_00E2399F
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push edx; mov dword ptr [esp], edi6_2_00E239BB
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push 725129A4h; mov dword ptr [esp], esp6_2_00E239E1
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push 6BD64571h; mov dword ptr [esp], edi6_2_00E23A4F
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push 5CD7A313h; mov dword ptr [esp], eax6_2_00E23A83
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push edx; mov dword ptr [esp], edi6_2_00E23B4E
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C340DD push eax; mov dword ptr [esp], ebp6_2_00E23B7B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3B0E6 push edi; mov dword ptr [esp], eax6_2_00E26AB8
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3B0E6 push eax; mov dword ptr [esp], ebp6_2_00E26BC3
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3908B push ecx; mov dword ptr [esp], edx6_2_00E19021
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3908B push ebx; mov dword ptr [esp], eax6_2_00E19044
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3908B push eax; mov dword ptr [esp], 194A00EBh6_2_00E19057
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3908B push edi; mov dword ptr [esp], 00D6AF5Bh6_2_00E19121
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3908B push 4A09B8EBh; mov dword ptr [esp], eax6_2_00E19170
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push edi; mov dword ptr [esp], edx6_2_00E16F99
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push 0242F1AFh; mov dword ptr [esp], ebx6_2_00E16FCF
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push 176328ABh; mov dword ptr [esp], edi6_2_00E16FE7
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push esi; mov dword ptr [esp], 5BB7B8A1h6_2_00E1708F
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push 58BB0EE8h; mov dword ptr [esp], ecx6_2_00E170B6
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C330BF push ebx; mov dword ptr [esp], edx6_2_00E1712C
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3186E push 212322F7h; mov dword ptr [esp], eax6_2_00E27B63
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3186E push esi; mov dword ptr [esp], ebp6_2_00E27BC7
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C3186E push 76A7464Dh; mov dword ptr [esp], edx6_2_00E27C23
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C34077 push ebp; mov dword ptr [esp], edi6_2_00E1D8CB
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C34077 push ecx; mov dword ptr [esp], ebp6_2_00E1D90B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C34077 push edx; mov dword ptr [esp], 000AABD3h6_2_00E1D97B
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00C34077 push 0E20700Ch; mov dword ptr [esp], edx6_2_00E1D9C2
                        Source: DLdiRYbSxUKrp0thTehxs0R7.exe.0.drStatic PE information: section name: entropy: 7.999611881196484
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, nbHRr4wrm68DvPGr2G8.csHigh entropy of concatenated method names: 'tm3JNKOfeW', 'dmaJ2LKJPv', 'z6oJOGdAkB', 'rGNJsT4K1w', 'hqWJQRmSLQ', 'kp6JCL917j', 'QOwJYYrNj7', 'Lj9w2n13yO', 'eJ2J8wCEuG', 'CU0JLqixeJ'
                        Source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, e7EuwtGMnIvwifDxGE0.csHigh entropy of concatenated method names: 'nwZuVFQvkC', 'g38PJ8K3c0', 'fpOulNOay4', 'tvNu1NQNXT', 'VZauNxh8gy', 'fCfu2lbAVZ', 'R1aBWr0WHY', 'L2UGSMfnEw', 'SQsGkNL33N', 'f5VGz55rr8'

                        Persistence and Installation Behavior

                        barindex
                        Drops PE files to the document folder of the user
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeJump to dropped file
                        Found pyInstaller with non standard icon
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                        Installs new ROOT certificates
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\BdeHdCfg.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_elementtree.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\backend_c.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\pyexpat.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\python3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32trace.pydJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeFile created: C:\Users\user\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\tQYsPom.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeFile created: C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\CameraSettingsUIHost.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeFile created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\libffi-7.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\libssl-1_1.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\win32ui.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_ssl.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\upx.exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32security.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140_1.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-util-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeFile created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\MSVCP140.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_shfoldr.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\libssl-1_1.dll (copy)Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\mfc140u.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_socket.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32net.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Space1.9_team[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\change.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\ssleay32.dll (copy)Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2eb29b48[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\grabber[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l2-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeFile created: C:\Users\user\AppData\Local\Temp\TaFd.XRAJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pythoncom38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\changepk.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-console-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_bz2.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-string-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\_win32sysloader.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_lzma.pydJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_hashlib.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\p508E0L2OxcFz21C_cBt.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default12_team[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\select.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32wnet.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\ucrtbase.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[2].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\unicodedata.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\python38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\netconn_properties.exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\bynA5XZaUopLU9g6Euj0.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_RegDLL.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil\_psutil_windows.pydJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rules[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_ctypes.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\is-3TV13.tmpJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\libcrypto-1_1.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pywintypes38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32api.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\registers.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\_cffi.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\is-0MI7C.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\libeay32.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_iscrypt.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\AppInstallerBackgroundUpdate.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeFile created: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\setup294[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\_queue.pydJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqln[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\is-FD6NC.tmpJump to dropped file
                        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\DEC.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeJump to dropped file
                        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\fcegbwtJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpFile created: C:\Users\user\AppData\Local\CD-DVD-Runner\is-3KPDG.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\atieclxx.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile created: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeFile created: C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile created: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeFile created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeFile created: C:\Users\user\AppData\Local\Temp\TaFd.XRAJump to dropped file
                        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\fcegbwtJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenfJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\128.pngJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\manifest.jsonJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\performance.jsJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.cssJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.htmlJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.jsJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\worker.jsJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadataJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadata\verified_contents.jsonJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settingsJump to behavior

                        Boot Survival

                        barindex
                        Creates multiple autostart registry keys
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c
                        Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeWindow searched: window name: RegmonClassJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeWindow searched: window name: RegmonClassJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeWindow searched: window name: RegmonClassJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeWindow searched: window name: RegmonClass
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeWindow searched: window name: RegmonClass
                        Uses schtasks.exe or at.exe to add and modify task schedules
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRulesJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "OBGPQMHF"

                        Hooking and other Techniques for Hiding and Protection

                        barindex
                        Hides that the sample has been downloaded from the Internet (zone.identifier)
                        Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Roaming\fcegbwt:Zone.Identifier read attributes | delete
                        Overwrites code with unconditional jumps - possibly settings hooks in foreign process
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeMemory written: PID: 1576 base: 7FF8C8A50008 value: E9 EB D9 E9 FF
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeMemory written: PID: 1576 base: 7FF8C88ED9F0 value: E9 20 26 16 00
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009A1A30 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_009A1A30
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

                        Malware Analysis System Evasion

                        barindex
                        Yara detected AntiVM3
                        Source: Yara matchFile source: Process Memory Space: Fb9COhEBuDNRhtMnCgGo2QiL.exe PID: 4068, type: MEMORYSTR
                        Checks if the current machine is a virtual machine (disk enumeration)
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                        Found API chain indicative of sandbox detection
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSandbox detection routine: GetCursorPos, DecisionNode, Sleepgraph_6-27031
                        Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeEvasive API call chain: GetPEB, DecisionNodes, Sleepgraph_6-27032
                        Found stalling execution ending in API Sleep call
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeStalling execution: Execution stalls by calling Sleepgraph_6-26305
                        Queries BIOS fan information (via WMI, Win32_Fan, often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Fan
                        Queries memory information (via WMI often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PortConnector
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_PhysicalConnector
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_Slot
                        Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
                        Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                        Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
                        Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PhysicalMemory
                        Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk
                        Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                        Queries temperature or sensor information (via WMI often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_NumericSensor
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_Sensor
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_TemperatureSensor
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation
                        Queries voltage information (via WMI often done to detect virtual machines)
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VoltageProbe
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_VoltageSensor
                        Query firmware table information (likely to detect VMs)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSystem information queried: FirmwareTableInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSystem information queried: FirmwareTableInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSystem information queried: FirmwareTableInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSystem information queried: FirmwareTableInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSystem information queried: FirmwareTableInformation
                        Tries to detect sandboxes / dynamic malware analysis system (registry check)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                        Source: wjwNFr_3XWBVO8HOPBPzLGWO.exe, 00000012.00000002.2710664530.0000000002E9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ASWHOOK
                        Source: M3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpBinary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL
                        Tries to evade debugger and weak emulator (self modifying code)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSpecial instruction interceptor: First address: 7FF77F1DCDCA instructions caused by: Self-modifying code
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeSpecial instruction interceptor: First address: 4F3339 instructions caused by: Self-modifying code
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeSpecial instruction interceptor: First address: F3E827 instructions caused by: Self-modifying code
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeSpecial instruction interceptor: First address: 576957 instructions caused by: Self-modifying code
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeSpecial instruction interceptor: First address: BCF9B7 instructions caused by: Self-modifying code
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory allocated: 1A60000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory allocated: 33B0000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory allocated: 30E0000 memory reserve | memory write watchJump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 1510000 memory reserve | memory write watch
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2FB0000 memory reserve | memory write watch
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 4FB0000 memory reserve | memory write watch
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,6_2_0097D9F0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeThread delayed: delay time: 300000Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeThread delayed: delay time: 300000Jump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 1267
                        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 452
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_6-26318
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\BdeHdCfg.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_elementtree.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\backend_c.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\pyexpat.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32trace.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\python3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\CameraSettingsUIHost.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\win32ui.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\ProgramData\nss3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_ssl.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\upx.exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-util-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32security.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_shfoldr.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\mfc140u.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_socket.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32net.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeDropped PE file which has not been started: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\ssleay32.dll (copy)Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\change.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l2-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pythoncom38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\TaFd.XRAJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\changepk.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-console-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_bz2.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-string-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\_win32sysloader.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_lzma.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_hashlib.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32wnet.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\select.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeDropped PE file which has not been started: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\ProgramData\softokn3.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\unicodedata.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\python38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\netconn_properties.exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\ProgramData\freebl3.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_RegDLL.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\bynA5XZaUopLU9g6Euj0.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil\_psutil_windows.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_ctypes.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\is-3TV13.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32api.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pywintypes38.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\_cffi.cp38-win_amd64.pydJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\exe\registers.exeJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\is-0MI7C.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\libeay32.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_iscrypt.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\AppInstallerBackgroundUpdate.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\_queue.pydJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqln[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\is-FD6NC.tmpJump to dropped file
                        Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DEC.exeJump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\CD-DVD-Runner\is-3KPDG.tmpJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\atieclxx.exeJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe TID: 6536Thread sleep count: 286 > 30Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe TID: 6536Thread sleep time: -57200s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe TID: 4308Thread sleep time: -300000s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe TID: 4616Thread sleep time: -600000s >= -30000sJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe TID: 5696Thread sleep count: 134 > 30Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe TID: 1568Thread sleep time: -30000s >= -30000sJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe TID: 2068Thread sleep count: 58 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe TID: 2068Thread sleep count: 60 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe TID: 2068Thread sleep count: 61 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe TID: 408Thread sleep count: 122 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe TID: 408Thread sleep count: 224 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe TID: 4580Thread sleep count: 41 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe TID: 408Thread sleep count: 111 > 30
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe TID: 2300Thread sleep count: 45 > 30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7864Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7864Thread sleep time: -30000s >= -30000s
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2928Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeFile opened: PhysicalDrive0
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\explorer.exeLast function: Thread delayed
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeThread delayed: delay time: 300000Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeThread delayed: delay time: 300000Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeThread delayed: delay time: 30000Jump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.0000000000698000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
                        Source: svchost.exe, 00000004.00000003.2043499640.000001FA30845000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2513974085.0000000006AB4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000068A000.00000004.00000020.00020000.00000000.sdmp, yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F25000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                        Source: Hrpxb3VVNyjyS2Of2WrcJREY.exe, 0000000F.00000003.2444818155.0000000001321000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2648077707.000002D501448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
                        Source: rvzZmTKhzLAk54H0OO5fg4xv.exe, 0000000E.00000003.2432316204.0000000002DAA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}i
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
                        Source: rvzZmTKhzLAk54H0OO5fg4xv.exe, 0000000E.00000003.2432316204.0000000002DB2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}(
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2602826536.0000000006AC2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                        Source: xNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmpBinary or memory string: main.isRunningInsideVMWare
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000003.2591934723.00000000006A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: svchost.exe, 00000002.00000002.2415447370.000001FDBA202000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                        Source: yyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000068A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&+
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                        Source: azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2505598874.0000000006AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeAPI call chain: ExitProcess graph end nodegraph_7-58541
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeSystem information queried: ModuleInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeProcess information queried: ProcessInformationJump to behavior

                        Anti Debugging

                        barindex
                        Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSystem information queried: CodeIntegrityInformation
                        Hides threads from debuggers
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeThread information set: HideFromDebuggerJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeThread information set: HideFromDebuggerJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeThread information set: HideFromDebuggerJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeThread information set: HideFromDebugger
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeThread information set: HideFromDebugger
                        Tries to detect sandboxes and other dynamic analysis tools (window names)
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: regmonclass
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: gbdyllo
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: procmon_window_class
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: ollydbg
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: filemonclass
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess queried: DebugObjectHandleJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeProcess queried: DebugObjectHandleJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess queried: DebugObjectHandleJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess queried: DebugObjectHandle
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess queried: DebugObjectHandle
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess queried: DebugPort
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6988B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6988B144
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_00938BB0 LoadLibraryA,GetProcAddress,6_2_00938BB0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0097D9F0 mov eax, dword ptr fs:[00000030h]6_2_0097D9F0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0097D9F0 mov eax, dword ptr fs:[00000030h]6_2_0097D9F0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_0093AB90 mov eax, dword ptr fs:[00000030h]6_2_0093AB90
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009360B0 mov ecx, dword ptr fs:[00000030h]6_2_009360B0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009346B0 mov eax, dword ptr fs:[00000030h]6_2_009346B0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009294C0 OutputDebugStringA,GetModuleHandleA,GetProcAddress,GetProcessHeap,HeapAlloc,HeapFree,HeapAlloc,HeapFree,6_2_009294C0
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess token adjusted: Debug
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess token adjusted: Debug
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess token adjusted: Debug
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess token adjusted: Debug
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6988B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6988B144
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6988948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6988948B
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory allocated: page read and write | page guardJump to behavior

                        HIPS / PFW / Operating System Protection Evasion

                        barindex
                        Benign windows process drops PE files
                        Source: C:\Windows\explorer.exeFile created: fcegbwt.48.drJump to dropped file
                        System process connects to network (likely due to code injection or exploit)
                        Source: C:\Windows\explorer.exeNetwork Connect: 172.67.196.94 443
                        Source: C:\Windows\explorer.exeNetwork Connect: 186.10.34.51 80
                        Allocates memory in foreign processes
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and writeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeMemory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2530000 protect: page execute and read and write
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
                        Creates a thread in another existing process (thread injection)
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeThread created: C:\Windows\explorer.exe EIP: 31819D0
                        Disables Windows Defender (deletes autostart)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
                        Found direct / indirect Syscall (likely to bypass EDR)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtQuerySystemInformation: Indirect: 0x7FF77F3C4DA5Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtSetInformationThread: Indirect: 0x7FF77F42E2A5Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtQueryInformationProcess: Indirect: 0x7FF77F41DA6BJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x141036FB5
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x140FE889D
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F5BD6CCJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x1416CF1D1
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F62EF94Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Indirect: 0x140F595B5
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F877A52Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtMapViewOfSection: Direct from: 0x14100CB88
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F61D9A5Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F7D87ECJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x1416AD85D
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F6310E6Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F548F53Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F7D726FJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F5B98FDJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtOpenFile: Direct from: 0x140FBB569
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F7D86D9Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x14102BFF1
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtQueryInformationProcess: Indirect: 0x7FF77F41DB99Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F7B8033Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x141037F5D
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeNtProtectVirtualMemory: Direct from: 0x7FF77F5522E2Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x141019C6D
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeNtProtectVirtualMemory: Direct from: 0x141699636
                        Injects a PE file into a foreign processes
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5AJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeMemory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2530000 value starts with: 4D5A
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                        LummaC encrypted strings found
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: wifeplasterbakewis.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: mealplayerpreceodsju.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: bordersoarmanusjuw.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: suitcaseacanehalk.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: absentconvicsjawun.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: pushjellysingeywus.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: economicscreateojsu.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: entitlementappwo.shop
                        Source: QnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2623770026.000000C000360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: stripmarrystresew.shop
                        Maps a DLL or memory area into another process
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read write
                        Source: C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read
                        Sample uses process hollowing technique
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000Jump to behavior
                        Writes to foreign memory regions
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 464000Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 4C0000Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EC7008
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeMemory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2530000
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeMemory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26F4008
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B2E008
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /S .\TaFD.XRA
                        Source: C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_698884B0 cpuid 7_2_698884B0
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe VolumeInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeQueries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeQueries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exeQueries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\certifi VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\lockfile VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\ucrtbase.dll VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_ctypes.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_bz2.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_lzma.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\nyv8h1dp VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pywintypes38.dll VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pythoncom38.dll VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32api.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g\gen_py\__init__.py VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g\gen_py\dicts.dat VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_socket.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\select.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\psutil\_psutil_windows.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32net.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32security.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_hashlib.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_ssl.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\backend_c.cp38-win_amd64.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\_queue.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md.cp38-win_amd64.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md__mypyc.cp38-win_amd64.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\unicodedata.pyd VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\win32 VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exeQueries volume information: C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe VolumeInformation
                        Source: C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exeCode function: 6_2_009FC84D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,6_2_009FC84D
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                        Lowering of HIPS / PFW / Operating System Security Settings

                        barindex
                        Disable Windows Defender real time protection (registry)
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\ExclusionsRegistry value created: Exclusions_Extensions 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableRoutinelyTakingAction 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{33071919-2175-4F9E-8105-BEAE0C730BFE}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRawWriteNotification 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableRoutinelyTakingAction 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\ExclusionsRegistry value created: Exclusions_Extensions 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
                        Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{797FD966-CE70-43C0-B62D-A8420EB91151}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRawWriteNotification 1Jump to behavior
                        Exclude list of file types from scheduled, custom, and real-time scanning
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeRegistry value created: Exclusions_Extensions 1Jump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeRegistry value created: Exclusions_Extensions 1Jump to behavior
                        Modifies Group Policy settings
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeFile written: C:\Windows\System32\GroupPolicy\gpt.iniJump to behavior
                        Modifies power options to not sleep / hibernate
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                        Source: C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
                        Source: C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
                        Source: C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

                        Stealing of Sensitive Information

                        barindex
                        Yara detected Glupteba
                        Source: Yara matchFile source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: xNcVS_VvZEHfTUaNtkua55mf.exe PID: 2140, type: MEMORYSTR
                        Yara detected LummaC Stealer
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Yara detected Mars stealer
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Yara detected PureLog Stealer
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPED
                        Yara detected RedLine Stealer
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.800000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000011.00000002.2302959218.000000000082D000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: tNKXm3LImvO5in9OelWM8_lp.exe PID: 1628, type: MEMORYSTR
                        Yara detected RisePro Stealer
                        Source: Yara matchFile source: 6.2.yyfBua979C0ZzSPnCxybIlhk.exe.920000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 22.2.azloBsQlDmB56PqIarSd7g7V.exe.c80000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000016.00000003.2518467991.0000000006B38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000016.00000003.2518348325.0000000006AC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000016.00000002.2602141465.000000000671F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: yyfBua979C0ZzSPnCxybIlhk.exe PID: 6776, type: MEMORYSTR
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zip, type: DROPPED
                        Yara detected SmokeLoader
                        Source: Yara matchFile source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                        Yara detected Stealc
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Yara detected Vidar stealer
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fedad0.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fedad0.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fc0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: M3c5GcarM7S9e4Fzg9fhkljA.exe PID: 1272, type: MEMORYSTR
                        Yara detected zgRAT
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPED
                        Tries to harvest and steal Bitcoin Wallet information
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
                        Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journalJump to behavior
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                        Tries to harvest and steal ftp login credentials
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                        Tries to steal Crypto Currency Wallets
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\MultiDoge\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Binance\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\backups\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\MultiDoge\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
                        Tries to steal Mail credentials (via file / registry access)
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
                        Source: C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

                        Remote Access Functionality

                        barindex
                        Yara detected Glupteba
                        Source: Yara matchFile source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: xNcVS_VvZEHfTUaNtkua55mf.exe PID: 2140, type: MEMORYSTR
                        Yara detected LummaC Stealer
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Yara detected Mars stealer
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Yara detected PureLog Stealer
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPED
                        Yara detected RedLine Stealer
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.800000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 17.2.tNKXm3LImvO5in9OelWM8_lp.exe.82dad0.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000011.00000002.2302959218.000000000082D000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: tNKXm3LImvO5in9OelWM8_lp.exe PID: 1628, type: MEMORYSTR
                        Yara detected RisePro Stealer
                        Source: Yara matchFile source: 6.2.yyfBua979C0ZzSPnCxybIlhk.exe.920000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 22.2.azloBsQlDmB56PqIarSd7g7V.exe.c80000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000016.00000003.2518467991.0000000006B38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000016.00000003.2518348325.0000000006AC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000016.00000002.2602141465.000000000671F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: yyfBua979C0ZzSPnCxybIlhk.exe PID: 6776, type: MEMORYSTR
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zip, type: DROPPED
                        Yara detected SmokeLoader
                        Source: Yara matchFile source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                        Yara detected Stealc
                        Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                        Yara detected Vidar stealer
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fedad0.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fedad0.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 21.2.M3c5GcarM7S9e4Fzg9fhkljA.exe.fc0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.3.8q5xyu0coQILTrboZdACo84I.exe.b20000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: M3c5GcarM7S9e4Fzg9fhkljA.exe PID: 1272, type: MEMORYSTR
                        Yara detected zgRAT
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.2.Fb9COhEBuDNRhtMnCgGo2QiL.exe.45ec010.5.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 7.0.Fb9COhEBuDNRhtMnCgGo2QiL.exe.af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, type: DROPPED
                        Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exeCode function: 7_2_6983A0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,7_2_6983A0C0

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        1
                        Software                        		Acquire InfrastructureValid Accounts1041
                        Windows Management Instrumentation                        		1
                        DLL Side-Loading                        		1
                        Abuse Elevation Control Mechanism                        		51
                        Disable or Modify Tools                        		2
                        OS Credential Dumping                        		1
                        System Time Discovery                        		Remote Services11
                        Archive Collected Data                        		1
                        Ingress Tool Transfer                        		Exfiltration Over Other Network MediumAbuse Accessibility Features
                        CredentialsDomainsDefault Accounts11
                        Native API                        		11
                        Windows Service                        		1
                        DLL Side-Loading                        		111
                        Deobfuscate/Decode Files or Information                        		1
                        Credential API Hooking                        		3
                        File and Directory Discovery                        		Remote Desktop Protocol1
                        Browser Session Hijacking                        		2
                        Encrypted Channel                        		Exfiltration Over BluetoothNetwork Denial of Service
                        Email AddressesDNS ServerDomain Accounts1
                        Shared Modules                        		1
                        Browser Extensions                        		1
                        Bypass User Account Control                        		1
                        Abuse Elevation Control Mechanism                        		11
                        Input Capture                        		366
                        System Information Discovery                        		SMB/Windows Admin Shares3
                        Data from Local System                        		1
                        Application Layer Protocol                        		Automated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal Accounts1
                        Exploitation for Client Execution                        		1
                        Scheduled Task/Job                        		11
                        Windows Service                        		4
                        Obfuscated Files or Information                        		1
                        Credentials in Registry                        		2291
                        Security Software Discovery                        		Distributed Component Object Model1
                        Email Collection                        		Protocol ImpersonationTraffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud Accounts2
                        Command and Scripting Interpreter                        		11
                        Registry Run Keys / Startup Folder                        		711
                        Process Injection                        		1
                        Install Root Certificate                        		LSA Secrets1
                        Process Discovery                        		SSH1
                        Credential API Hooking                        		Fallback ChannelsScheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable Media1
                        Scheduled Task/Job                        		RC Scripts1
                        Scheduled Task/Job                        		43
                        Software Packing                        		Cached Domain Credentials1081
                        Virtualization/Sandbox Evasion                        		VNC11
                        Input Capture                        		Multiband CommunicationData Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote Services1
                        Service Execution                        		Startup Items11
                        Registry Run Keys / Startup Folder                        		1
                        Timestomp                        		DCSync1
                        Application Window Discovery                        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by Compromise1
                        PowerShell                        		Scheduled Task/JobScheduled Task/Job1
                        DLL Side-Loading                        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                        Bypass User Account Control                        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron21
                        Masquerading                        		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                        Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1081
                        Virtualization/Sandbox Evasion                        		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                        Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task711
                        Process Injection                        		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                        Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                        Hidden Files and Directories                        		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1428462 Sample: SecuriteInfo.com.Win64.Evo-... Startdate: 19/04/2024 Architecture: WINDOWS Score: 100 139 Found malware configuration 2->139 141 Malicious sample detected (through community Yara rule) 2->141 143 Antivirus detection for dropped file 2->143 145 21 other signatures 2->145 8 SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe 11 56 2->8         started        13 svchost.exe 2->13         started        15 svchost.exe 2->15         started        17 2 other processes 2->17 process3 dnsIp4 123 87.240.137.164 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 8->123 125 95.142.206.0 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 8->125 127 19 other IPs or domains 8->127 105 C:\Users\...\yyfBua979C0ZzSPnCxybIlhk.exe, PE32 8->105 dropped 107 C:\Users\...\xNcVS_VvZEHfTUaNtkua55mf.exe, PE32 8->107 dropped 109 C:\Users\...\wjwNFr_3XWBVO8HOPBPzLGWO.exe, PE32 8->109 dropped 111 29 other malicious files 8->111 dropped 199 Query firmware table information (likely to detect VMs) 8->199 201 Drops PE files to the document folder of the user 8->201 203 Creates HTML files with .exe extension (expired dropper behavior) 8->203 205 11 other signatures 8->205 19 Honz_MBQI6vCkcbyCN3yB4rh.exe 8->19         started        23 M3c5GcarM7S9e4Fzg9fhkljA.exe 8->23         started        25 azloBsQlDmB56PqIarSd7g7V.exe 8->25         started        30 15 other processes 8->30 28 Install.exe 13->28         started        file5 signatures6 process7 dnsIp8 67 C:\Users\...\backend_c.cp38-win_amd64.pyd, PE32+ 19->67 dropped 69 C:\Users\user\...\_cffi.cp38-win_amd64.pyd, PE32+ 19->69 dropped 79 75 other files (35 malicious) 19->79 dropped 147 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->147 149 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 19->149 151 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->151 165 9 other signatures 19->165 32 conhost.exe 19->32         started        34 Honz_MBQI6vCkcbyCN3yB4rh.exe 19->34         started        167 4 other signatures 23->167 36 RegAsm.exe 23->36         started        41 conhost.exe 23->41         started        129 193.233.132.253 FREE-NET-ASFREEnetEU Russian Federation 25->129 131 104.26.4.15 CLOUDFLARENETUS United States 25->131 71 C:\Users\user\...\p508E0L2OxcFz21C_cBt.exe, PE32 25->71 dropped 81 4 other malicious files 25->81 dropped 153 Query firmware table information (likely to detect VMs) 25->153 155 Tries to detect sandboxes and other dynamic analysis tools (window names) 25->155 157 Tries to steal Mail credentials (via file / registry access) 25->157 169 6 other signatures 25->169 43 Conhost.exe 25->43         started        73 C:\Users\user\AppData\Local\...\tQYsPom.exe, PE32 28->73 dropped 159 Multi AV Scanner detection for dropped file 28->159 133 185.172.128.23 NADYMSS-ASRU Russian Federation 30->133 135 147.45.47.93 FREE-NET-ASFREEnetEU Russian Federation 30->135 137 193.233.132.226 FREE-NET-ASFREEnetEU Russian Federation 30->137 75 C:\Users\user\AppData\Local\...\is-RKCCV.tmp, PE32 30->75 dropped 77 C:\Users\user\...\bynA5XZaUopLU9g6Euj0.exe, PE32 30->77 dropped 83 31 other files (27 malicious) 30->83 dropped 161 Detected unpacking (changes PE section rights) 30->161 163 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 30->163 171 19 other signatures 30->171 45 is-RKCCV.tmp 30->45         started        47 explorer.exe 30->47 injected 49 RegAsm.exe 30->49         started        51 9 other processes 30->51 file9 signatures10 process11 dnsIp12 113 37.27.87.155 UNINETAZ Iran (ISLAMIC Republic Of) 36->113 115 23.76.43.59 AMXArgentinaSAAR United States 36->115 85 C:\Users\user\AppData\...\softokn3[1].dll, PE32 36->85 dropped 87 C:\Users\user\AppData\Local\...\sqln[1].dll, PE32 36->87 dropped 99 5 other files (3 malicious) 36->99 dropped 173 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 36->173 175 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 36->175 177 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 36->177 191 2 other signatures 36->191 53 conhost.exe 41->53         started        89 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 45->89 dropped 91 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 45->91 dropped 93 C:\Users\user\AppData\Local\...\_RegDLL.tmp, PE32 45->93 dropped 101 10 other files (9 malicious) 45->101 dropped 55 cddvdrunner2333.exe 45->55         started        117 186.10.34.51 ENTELCHILESACL Chile 47->117 119 172.67.196.94 CLOUDFLARENETUS United States 47->119 95 C:\Users\user\AppData\Roaming\fcegbwt, PE32 47->95 dropped 97 C:\Users\user\AppData\Local\Temp\DEC.exe, PE32 47->97 dropped 179 System process connects to network (likely due to code injection or exploit) 47->179 181 Benign windows process drops PE files 47->181 183 Hides that the sample has been downloaded from the Internet (zone.identifier) 47->183 121 5.42.65.50 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 49->121 185 Installs new ROOT certificates 49->185 187 Tries to harvest and steal browser information (history, passwords, etc) 49->187 189 Tries to steal Crypto Currency Wallets 49->189 59 conhost.exe 51->59         started        61 conhost.exe 51->61         started        63 conhost.exe 51->63         started        65 2 other processes 51->65 file13 signatures14 process15 file16 103 C:\ProgramData\...\ImageGuide 3.1.33.66.exe, PE32 55->103 dropped 193 Multi AV Scanner detection for dropped file 55->193 195 Detected unpacking (changes PE section rights) 55->195 197 Detected unpacking (overwrites its own PE header) 55->197 signatures17

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe21%ReversingLabs

                        Dropped Files

                        SourceDetectionScannerLabelLink
                        C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe100%AviraTR/AD.Nekark.sbdpe
                        C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe100%AviraTR/AD.Nekark.sbdpe
                        C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe100%Joe Sandbox ML
                        C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe100%Joe Sandbox ML
                        C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe100%Joe Sandbox ML
                        C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
                        C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exe100%Joe Sandbox ML
                        C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exe49%ReversingLabsWin32.Trojan.Generic
                        C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe33%ReversingLabsWin32.Trojan.Privateloader
                        C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\ProgramData\freebl3.dll0%ReversingLabs
                        C:\ProgramData\mozglue.dll0%ReversingLabs
                        C:\ProgramData\msvcp140.dll0%ReversingLabs
                        C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe88%ReversingLabsWin64.Trojan.Privateloader
                        C:\ProgramData\nss3.dll0%ReversingLabs
                        C:\ProgramData\softokn3.dll0%ReversingLabs
                        C:\ProgramData\vcruntime140.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe33%ReversingLabsWin32.Trojan.Privateloader
                        C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe49%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\CD-DVD-Runner\is-0MI7C.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\CD-DVD-Runner\is-3KPDG.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\CD-DVD-Runner\is-3TV13.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\CD-DVD-Runner\libeay32.dll (copy)0%ReversingLabs
                        C:\Users\user\AppData\Local\CD-DVD-Runner\libssl-1_1.dll (copy)0%ReversingLabs
                        C:\Users\user\AppData\Local\CD-DVD-Runner\ssleay32.dll (copy)0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\grabber[1].exe16%ReversingLabsWin64.Malware.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqln[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe88%ReversingLabsWin64.Trojan.Privateloader
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Space1.9_team[1].exe30%ReversingLabsWin32.Trojan.Privateloader
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exe88%ReversingLabsByteCode-MSIL.Trojan.LummaStealer
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe27%ReversingLabsWin32.Trojan.Privateloader
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default12_team[1].exe34%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[1].exe33%ReversingLabsWin32.Trojan.Privateloader
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[2].exe33%ReversingLabsWin32.Trojan.Privateloader
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe30%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\AppInstallerBackgroundUpdate.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\BdeHdCfg.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\CameraSettingsUIHost.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe34%ReversingLabsWin32.Adware.Generic
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\atieclxx.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\change.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\changepk.exe0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\tQYsPom.exe34%ReversingLabsWin32.Adware.Generic
                        C:\Users\user\AppData\Local\Temp\DEC.exe96%ReversingLabsByteCode-MSIL.Trojan.RedLine
                        C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\MSVCP140.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\mfc140u.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\win32ui.pyd0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140_1.dll0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\_bz2.pyd0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\_ctypes.pyd0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\_MEI56642\_elementtree.pyd0%ReversingLabs

                        Unpacked PE Files

                        ⊘No Antivirus matches

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        ⊘No Antivirus matches

                        Domains and IPs

                        Contacted Domains

                        ⊘No contacted domains info

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://sodez.ru/tmp/index.phptrue
                          economicscreateojsu.shoptrue
                            entitlementappwo.shoptrue
                              http://uama.com.ua/tmp/index.phptrue
                                bordersoarmanusjuw.shoptrue
                                  http://talesofpirates.net/tmp/index.phptrue

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    http://5.42.66.10/download/page_error.pngDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                      http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopResponseRFb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpfalse
                                        https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe.exeSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                          http://193.233.132.139/dacha/rules.exeSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                            https://sun6-21.userapi.com/c236331/u5294803/docs/d24/3cad94b79c70/imgdrive_2_1.bmp?extra=KSt_51f-h8SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                              https://palberryslicker.sbs/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                https://papi.vk.com/pushsse/ruimSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153658618.000002262F7EB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  https://meet.crazyfigs.top/2SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    https://baldurgatez.com/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      https://docs.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        https://ipinfo.io:443/widget/demo/81.181.57.52cyyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.00000000006B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          https://vk.comSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            https://www.instagram.comSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              https://st6-22.vk.com/dist/web/docs.20074c02.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                https://aui-cdn.atlassian.com/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  http://5.42.66.10:80/download/page_error.pngZZDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000FAB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    http://www.innosetup.comSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108082037.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA3C000.00000004.00000020.00020000.00000000.sdmp, jToGBYVMqv5v7FLLCc3PnzZj.exe, 0000000D.00000000.2240084953.0000000000410000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                      http://5.42.66.10:80/api/flash.phpDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        http://ACVC.WPF.Service.WcfTFb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpfalse
                                                                          http://193.233.132.253/lumma1504.exeazloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            https://api.ip.sb/iptNKXm3LImvO5in9OelWM8_lp.exe, 00000011.00000002.2302959218.000000000082D000.00000004.00000001.01000000.00000010.sdmpfalse
                                                                              https://st6-22.vk.com/dist/web/ui_common.88618847.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                https://chrome.google.com/webstoreDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  https://drive-daily-2.corp.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    https://iplogger.org:443/1nhuM4.jsDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      https://st6-22.vk.com/dist/web/page_layout.7b5800c2.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        https://st6-22.vk.com/dist/web/polyfills.isolated.edaffb7b.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          https://t.me/RiseProSUPPORTyyfBua979C0ZzSPnCxybIlhk.exe, 00000006.00000002.2653655280.000000000063E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            http://185.172.128.203/dl.php(SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              http://5.42.66.10/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                http://www.symauth.com/cps0(OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  https://bbuseruploads.s3.amazonaws.com/8b0be658-c958-47a3-96e4-fc8e5fe7c5dc/downloads/dc50f97b-477f-SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2112981350.000002262FA85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA04000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168867567.000002262FA8D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2104775379.000002262FA8A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    https://drive-daily-1.corp.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      https://drive-daily-5.corp.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        http://5.42.66.10/download/page_error.png.DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          http://https://_bad_pdb_file.pdbxNcVS_VvZEHfTUaNtkua55mf.exe, 00000008.00000001.2312742116.0000000000ACD000.00000004.00000001.01000000.00000008.sdmpfalse
                                                                                                            https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exeSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              https://stats.vk-portal.netSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                https://page-error.comJDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513255238.0000000003787000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513294818.000000000378A000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513385608.0000000003790000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  https://meet.crazyfigs.top/style/060.exep/0/6SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    http://127.0.0.1:Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpfalse
                                                                                                                      https://st6-22.vk.com/css/al/fonts_utf.7fa94ada.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        https://ipinfo.io/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E06000.00000004.00000020.00020000.00000000.sdmp, azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          https://st6-22.vk.com/dist/web/common_web.6a09f0e1.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            http://www.symauth.com/rpa00OPHZ4RYtForDNHqUKDzFdbyl.exe, 0000000A.00000003.2319633989.0000000002150000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              https://r.mradx.netSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                https://st6-22.vk.com/dist/web/unauthorized.20074c02.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  https://cdn.cookielaw.org/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103226461.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103034067.000002262F9FF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103595029.000002262FA11000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    https://iplis.ru/_FDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBLazloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000003.2497090817.000000000675A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        https://chromewebstore.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          https://monoblocked.com:80/525403/setup.exen$SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            https://palberryslicker.sbs/rSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              https://drive-preprod.corp.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513221526.0000000003798000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                https://urn.to/r/sds_seeFb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000002.2628063256.00000000033B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  https://chrome.google.com/webstore/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513717785.0000000003783000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    https://st6-22.vk.com/dist/web/raven_logger.ea0a2239.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      http://185.172.128.203/dl.php.exeSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        https://sandbox.google.com/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2513255238.0000000003787000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          https://static.vk.meSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            https://sun6-21.userapi.com/pSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142139632.000002262FA0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              http://193.233.132.253/lumma1504.exen%$azloBsQlDmB56PqIarSd7g7V.exe, 00000016.00000002.2600009840.0000000001E48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                https://github.com/moq/moq4Fb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpfalse
                                                                                                                                                                  https://st6-22.vk.com/dist/web/chunks/react.759f82b6.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    https://t.me/irfailAtM3c5GcarM7S9e4Fzg9fhkljA.exe, 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmpfalse
                                                                                                                                                                      https://monoblocked.com/525403/setup.exenet/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        https://iplis.ru/sDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          http://5.42.66.10:80/api/flash.php3DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            https://st6-22.vk.comSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153636596.000002262FAA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153762628.000002262F7D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168948070.000002262FA5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FAA4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              https://iplis.ru/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                https://iplis.ru:443/1pRXr7.txtDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  https://iplogger.org/DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    https://ipinfo.io/namehttps://ipgeolocation.io/:DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2589232742.00000000002FF000.00000002.00000001.01000000.0000000A.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000003.2411267986.0000000000E60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      https://carthewasher.net/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        https://monoblocked.com/SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103641640.000002262F7ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2103387031.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          https://st6-22.vk.com/dist/web/performance_observers.4d12f60f.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            http://5.42.66.10/download/page_error.jpegDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              https://cdn.ampproject.orgSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                https://management.core.usgovcloudapi.netGODEBUGQnkREgWvOVM7UiM40Bqj5sWB.exe, 00000014.00000002.2682443950.00007FF6563F9000.00000002.00000001.01000000.00000013.sdmpfalse
                                                                                                                                                                                                  https://st6-22.vk.com/css/al/vk_sans_display_faux.7d208ecb.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    https://monoblocked.com/525403/setup.exeSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140162487.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2113407483.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2110942258.000002262FA82000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2112684823.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108279479.000002262FA62000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153701038.000002262F7F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2129457218.000002262F807000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2142500568.000002262F805000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140516709.000002262F7F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108740822.000002262FA82000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2122517096.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140554515.000002262F804000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2140478198.000002262F7EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108180577.000002262FA61000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2115459164.000002262FA7E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2108397207.000002262FA80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      https://iplis.ru/1tqHh7.mp3DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        https://st6-22.vk.com/dist/web/chunks/vkui.bce4c996.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          https://iplis.ru/RDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            https://iplis.ru/PDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              https://baldurgatez.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe;2SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F7ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                https://st6-22.vk.com/dist/web/jobs_devtools_notification.14f96f02.jsSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  https://www.security.us.panasonic.comFb9COhEBuDNRhtMnCgGo2QiL.exe, 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmpfalse
                                                                                                                                                                                                                    http://5.42.66.10/rIMaDLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.00000000037B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      http://5.42.66.10/download/th/retail.php12.phpSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2094424127.000002262F81A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        http://5.42.66.10/download/page_error.jpegF3DLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2592639535.0000000000F31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                          https://st6-22.vk.com/dist/web/chunks/audioplayer-lib.93b52d88.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            https://st6-22.vk.com/dist/web/site_layout.20074c02.cssSecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168705727.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153119533.000002262FC23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152524641.000002262FE7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2152745201.000002262FC22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2168162607.000002262FBE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, 00000000.00000003.2153520987.000002262FA8D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                              https://iplis.ru:443/1BV4j7.mp4ODLdiRYbSxUKrp0thTehxs0R7.exe, 00000009.00000002.2594870713.0000000003770000.00000004.00000020.00020000.00000000.sdmpfalse

                                                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                193.233.132.139
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                34.117.186.192
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                                                104.26.9.59
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                172.67.196.94
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                                                52.216.50.177
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                                                37.221.125.202
                                                                                                                                                                                                                                		unknownLithuania
                                                                                                                                                                                                                                		62416PTSERVIDORPTfalse
                                                                                                                                                                                                                                172.67.216.172
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                18.205.93.1
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                193.233.132.253
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                87.240.137.164
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                                                                                                                                                23.76.43.59
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		19037AMXArgentinaSAARfalse
                                                                                                                                                                                                                                172.67.161.113
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                172.67.132.113
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                172.67.169.146
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                95.142.206.0
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                                                                                                                                                5.42.65.50
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		39493RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRUtrue
                                                                                                                                                                                                                                147.45.47.93
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                95.142.206.1
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                                                                                                                                                104.21.63.150
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                172.67.207.236
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                37.27.87.155
                                                                                                                                                                                                                                		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                                                                                                		39232UNINETAZfalse
                                                                                                                                                                                                                                185.172.128.203
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		50916NADYMSS-ASRUfalse
                                                                                                                                                                                                                                193.233.132.226
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                109.175.29.39
                                                                                                                                                                                                                                		unknownBosnia and Herzegowina
                                                                                                                                                                                                                                		9146BIHNETBIHNETAutonomusSystemBAfalse
                                                                                                                                                                                                                                186.10.34.51
                                                                                                                                                                                                                                		unknownChile
                                                                                                                                                                                                                                		6471ENTELCHILESACLtrue
                                                                                                                                                                                                                                185.172.128.23
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		50916NADYMSS-ASRUtrue
                                                                                                                                                                                                                                104.26.4.15
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                104.21.5.28
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                5.42.66.10
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		39493RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRUfalse
                                                                                                                                                                                                                                104.21.91.214
                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                45.130.41.108
                                                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                                                		198610BEGET-ASRUfalse

                                                                                                                                                                                                                                General Information

                                                                                                                                                                                                                                Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                                                Analysis ID:1428462
                                                                                                                                                                                                                                Start date and time:2024-04-19 00:39:08 +02:00
                                                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                                Overall analysis duration:0h 13m 53s
                                                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                                Number of analysed new started processes analysed:49
                                                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                                                Number of injected processes analysed:1
                                                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                                                Sample name:SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                                                Classification:mal100.rans.troj.spyw.evad.winEXE@214/396@0/31
                                                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                                                • Successful, ratio: 66.7%
                                                                                                                                                                                                                                HCA Information:Failed
                                                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                                                • Found application associated with file extension: .exe

                                                                                                                                                                                                                                Warnings

                                                                                                                                                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
                                                                                                                                                                                                                                • Execution Graph export aborted for target DLdiRYbSxUKrp0thTehxs0R7.exe, PID 368 because there are no executed function
                                                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                                • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                                                                • VT rate limit hit for: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe

                                                                                                                                                                                                                                Simulations

                                                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                                                00:40:20API Interceptor18x Sleep call for process: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe modified
                                                                                                                                                                                                                                00:40:23API Interceptor1x Sleep call for process: Fb9COhEBuDNRhtMnCgGo2QiL.exe modified
                                                                                                                                                                                                                                00:40:29API Interceptor1x Sleep call for process: GDL7jRat1qTWaJDTi_iESGFr.exe modified
                                                                                                                                                                                                                                00:40:34API Interceptor6x Sleep call for process: xNcVS_VvZEHfTUaNtkua55mf.exe modified
                                                                                                                                                                                                                                00:40:34API Interceptor5x Sleep call for process: f5PK0Fmcntr6Bz8d571_sPMM.exe modified
                                                                                                                                                                                                                                00:40:35Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                00:40:35API Interceptor986x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                                                00:40:35AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                00:40:39Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                00:40:41API Interceptor89x Sleep call for process: RegAsm.exe modified
                                                                                                                                                                                                                                00:40:46AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                00:40:50Task SchedulerRun new task: bwrroZoeZRoQVpyAcj path: C:\Users\user\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\tQYsPom.exe s>ZO /wWsite_idlDp 525403 /S
                                                                                                                                                                                                                                00:40:54Task SchedulerRun new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
                                                                                                                                                                                                                                00:40:54Task SchedulerRun new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
                                                                                                                                                                                                                                00:40:57AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
                                                                                                                                                                                                                                00:41:09Task SchedulerRun new task: gzsSiudEb path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                00:41:13AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
                                                                                                                                                                                                                                00:41:25Task SchedulerRun new task: Firefox Default Browser Agent 810E7727233AE4AD path: C:\Users\user\AppData\Roaming\fcegbwt
                                                                                                                                                                                                                                00:41:30Task SchedulerRun new task: qXnxKrbPbFSTFetyh path: C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\oPANMoY.exe s>ob /tVsite_idNXL 525403 /S
                                                                                                                                                                                                                                00:41:44Task SchedulerRun new task: MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe HR path: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe
                                                                                                                                                                                                                                00:41:45Task SchedulerRun new task: MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe LG path: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe
                                                                                                                                                                                                                                00:41:47AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe
                                                                                                                                                                                                                                00:41:48Task SchedulerRun new task: MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec HR path: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe
                                                                                                                                                                                                                                00:41:51Task SchedulerRun new task: MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec LG path: C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe
                                                                                                                                                                                                                                00:41:58Task SchedulerRun new task: NetXkRqHZJDfE2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\mMAjWdbxOIjSziVB\gvsoDQy.wsf^""
                                                                                                                                                                                                                                00:42:03AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exe

                                                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                                                IPs

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                C:\ProgramData\AAKJEGCFBGDHJJJJJKJECFCFCA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\AEGDBAFH

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\AFHDHCAA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\AKFCFBAAEHCFHJJKEHJK

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\BAFCFBAEGDHIEBFHDGCBAECFBG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\BFIIIDAFBFBKECBGDBGI

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\CGCAKKKE

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\CZQKSDDMWR.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.700739677288544
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
                                                                                                                                                                                                                                MD5:57582F5B6AE65D8DFCBD4A26382C6138
                                                                                                                                                                                                                                SHA1:DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
                                                                                                                                                                                                                                SHA-256:7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
                                                                                                                                                                                                                                SHA-512:6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

                                                                                                                                                                                                                                C:\ProgramData\DAKFCGIJKJKFHIDHIIIEBGCBFB

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\DHCFIDAK

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\DWTHNHNNJB.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.706547634051575
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:hvsWN1mO5uGrz/I7zHH1p0zqzlGo9+kLDw5vXGTxrVYDH+:h3N8O5Rrz/Ww4lGoPLdVg+
                                                                                                                                                                                                                                MD5:B8F3A1455E95B1CF3432BF983042773B
                                                                                                                                                                                                                                SHA1:F205A118C84B93F8D41F9F3A0C3F5739B308A3BD
                                                                                                                                                                                                                                SHA-256:F28BAE1CF8CA75EF22D6F1B09E711B7CE094E88420F0085CD54522F42E2F01CC
                                                                                                                                                                                                                                SHA-512:8E565B641B5FD2E12605880EDE93270A75B170462139E0A604E9392EAE17E9ED898657AC5CF3940D6642FA1C30932B5457C5ED3F48945406D8D52FFDAE4C75EC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:DWTHNHNNJBNUOLHJSZISMDGJOYXTZZHUGXLVDUQRAEGRPGUJZOCKQITJDWWXLEKCBGNUXRHFKQNVYEOUAPWVUNRKEGOVRSMLUWJEDVYMGZNTPHFYBRBQKTDCSSUSYEFMSBVJIUZXBZTSOHJUGSMYXMCHCXFJRJWCIMIIBLQTYLCFAYBJJDFARAIASDNTGSCWOVPZQVOLZSDXHBWJKTFKDASDWBZAKTZORAZAYMGQAWYBXYSFHGIFDLGGWKOZHAKPMQDVATIAOQBMHQSPKRBCMODLQIXQPGYLUPHCCYRGFMMUNVADRWLBPHJTZMIBWBBNTGIKVBMISXLSCBVIJKSLAYUGSXYTWZXZEUNPSJHQDCYEUFAEFXVKTZLRWTCCBJEUMWRIOJQZDSKPYAXWZFFGELTRSKYQLZIJELZOOYTMOTXAVQFHZOTOYJRTETJWEYJSIKLGRPKHTDUAISIYRKTOTNIFBGJZDDLKNVDBWZPCZRBGCQVYWVVYPGSOJLVEEYAEGKNLGKHGWDNSTUBBACNMNKWHSEVSQQBPUBUQDPMAYUMOEKRDDULTRBJHROGAKDVOBRFGLXLEPPGPAOSMYHGQPLZVPJQPHVJECMGUAKGHDTRXXACRQCFVKNWHWLHHCPJPVQQVIJGFKFVKEZUOFIJPAGHPJNNXVXIPDRSYFAAUMDAXMMQYHYXSQCVGYKVCLTYUTCPZJEMADJIUEQIXZWEBGFSJRPNCJBGIRLATPCTHDDTOZYQETROWIDHELZOIYGROYRHTLACZEAAOGNJQWDLKLGFABXVJYRCNUWGFVDZUUJMAZAOCPBSGXKYOBTOFSVELAWARUWBQDAJUSVWCITXEQOPHLMEQQFXPPYDIRXJXPELMDYSPWTSNOQKFKNHOSIBCKLQWNBVVZSZKFPEPAAYEMUOZCVBZFPQTOSLEUQFOMZPXBRUFRPVLLIMOKJVZSYBIUFACEGBCKQVRWLXWDOKKECLVGPWOMOUDVXKXHIQF

                                                                                                                                                                                                                                C:\ProgramData\EBGCBAFCGDAAKFIDGIEGDGDHID

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\EFOYFBOLXA.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.696178193607948
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                                                                                MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                                                                                SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                                                                                SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                                                                                SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                                                                                C:\ProgramData\EWZCVGNOWT.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.690071120548773
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                                                                                MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                                                                                SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                                                                                SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                                                                                SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                                                                                C:\ProgramData\GLTYDMDUST.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.69569301223482
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
                                                                                                                                                                                                                                MD5:CA404BEA65D84F58838AF73B2DC67E02
                                                                                                                                                                                                                                SHA1:56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
                                                                                                                                                                                                                                SHA-256:4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
                                                                                                                                                                                                                                SHA-512:10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

                                                                                                                                                                                                                                C:\ProgramData\GNLQNHOLWB.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.698695541849584
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
                                                                                                                                                                                                                                MD5:64E7020B0B401F75D3061A1917D99E04
                                                                                                                                                                                                                                SHA1:785E09A2F76464E26CE282F41DE07D1B27FFB855
                                                                                                                                                                                                                                SHA-256:9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
                                                                                                                                                                                                                                SHA-512:14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

                                                                                                                                                                                                                                C:\ProgramData\GRXZDKKVDB.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.697358951122591
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                                                                                MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                                                                                SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                                                                                SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                                                                                SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                                                                                C:\ProgramData\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.697358951122591
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                                                                                MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                                                                                SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                                                                                SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                                                                                SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                                                                                C:\ProgramData\HIEHDAFH

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\IECFHDBAAECAAKFHDHIIJKFHJE

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\IIEHJEHD

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\ImageGuide 3.1.33.66\ImageGuide 3.1.33.66.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3948834
                                                                                                                                                                                                                                Entropy (8bit):6.382123082161787
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:3egaBHXr8oHOIlk8TlTwGRWH9M5odueM6V:FaBHRz2djueZ
                                                                                                                                                                                                                                MD5:00B640E64C35C1E3F7AD1CB9A979BF2E
                                                                                                                                                                                                                                SHA1:FDAC8B1FCA30576355B38345E045601EC2BA41E2
                                                                                                                                                                                                                                SHA-256:A2CE846A84F5BD3D1CB8C0449915508DFCA1F67F6CC12A435F17A411E5D48012
                                                                                                                                                                                                                                SHA-512:B2C94D43A899490864F17246CB8254EF44EDB6AE76A23EB3AC369B5391E7F42BE6D6BC816E9E0A1487E841AF2C5E801FB9070E42A04810D01AC1A81DEF715C1C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 49%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.....................`.......u............@...........................<.............................................\........p...............................................................................................................text............................... ..`.rdata...6.......@..................@..@.data....T.......0..................@....rsrc........p.......@..............@..@.rview4..P*..0.."A*.................a.%.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\JDAFBKECAKFCAAAKJDAKJEGDAF

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\JDBGDHIIDAEBFHJJDBFI

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\JDGCGHCGHCBFHJJKKJEHJEHJEH

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\KEBFBGDGHIIJJKEBKJDB

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\MPGPH131\MPGPH131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):921600
                                                                                                                                                                                                                                Entropy (8bit):7.559067836582103
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:qqTm7F2KYgS5KTXxvmwT5aL4P8zre91t9olr:2FXO5KTXZJ0LOAatmr
                                                                                                                                                                                                                                MD5:65BE3195B801D271E01D41F7BF576BD8
                                                                                                                                                                                                                                SHA1:9E20D649EE0884F8800EF67315CAF56C7A6EAA03
                                                                                                                                                                                                                                SHA-256:EE877A4CAEC81C88DDD006C50A8196EADABE873CC6456ECF0D93150E839BC915
                                                                                                                                                                                                                                SHA-512:C84A1863AAECE69B04BEACCD20BF74B1F5BB691D8B401E8613BAD717F5E5A94940E1B129B33AE3EB62E2D62EA988E904388F2E3B1AC35828B4441800FACF6F4C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S..D=P.D=P.D=P...P.D=P...P.D=P...P.D=P.FP.D=P.D<P.D=P...P.D=P...P.D=P...P.D=PRich.D=P................PE..L...Z^.d...........................N.............@..........................@..............................................<...<....`..................................................................@............................................text.............................. ..`.rdata..de.......f..................@..@.data.....~..0......................@....tls.........P.......,..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\MSIUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\MSIUpdaterV1.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 33%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER12A5.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95236
                                                                                                                                                                                                                                Entropy (8bit):3.0884087275393495
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:zMd3Gz3OB2gkoK5DMxgvL7KZLXmcA6VNXxaq+x736+b+X+3+Z+2+3evg+DU+5+3Q:zMd3Gz3OB2gkoK5DMxgvL7KZLXmcA6VF
                                                                                                                                                                                                                                MD5:CE24E00319FC8E20FF38AECD2632EE7C
                                                                                                                                                                                                                                SHA1:91B932E02D92CF7849FD78CC7862E5571DD10187
                                                                                                                                                                                                                                SHA-256:43B5333F5BA88E4CB8299177A754B0FA2C4C0B1E97CFF5E1E758CA5654C50BC6
                                                                                                                                                                                                                                SHA-512:BA53FEAA725CEA1BCE3676D963F57A246DE2386CB5A5ABD9B3FC08FBD30C5B74149F959EDB5FF949A67A7D2BE4717F6AF77E54BCC4EFC125BC8D8893E0355538
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER13EE.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6992971499046177
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtr5FV+YMYmFzPvHfYEZ2BtFiY3ADcwHVHBhaCxkElMUu4IlstH:2ZDvtU7HQwXaCxkWMUufGtH
                                                                                                                                                                                                                                MD5:A2B5A8D43C17D383D4180DC57C53EFA9
                                                                                                                                                                                                                                SHA1:6C7FFA5D0909DB74F9334470326770317E3D33D1
                                                                                                                                                                                                                                SHA-256:D7D7DB2FBAB5AB015E2C92C461B37D7320B37AA8789DF14A81A56B6C048D7F83
                                                                                                                                                                                                                                SHA-512:D487ED870FCCF55A3258A167B2EAA583475C09D9E80DD1EA3F7BCF10525E9581348CB12D1ADFCDF313BC3EB7AB13CC4B3F1AC8A9EADE677404AABBF790AD193D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER193E.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95210
                                                                                                                                                                                                                                Entropy (8bit):3.089024305786439
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:Lb13wda3e6Qv8FYuMzvvL7KZLD+cAHeHXxaq+x736+b+X+3+Z+2+3evg+DU+5+33:Lb13wda3e6Qv8FYuMzvvL7KZLD+cAHew
                                                                                                                                                                                                                                MD5:A61093F11B148374F28FCB8C06986C7A
                                                                                                                                                                                                                                SHA1:E99BCB3CF33846D0135A1A894260E6D377E9D267
                                                                                                                                                                                                                                SHA-256:4DD8137AE1193DA58DA092ECD733D64FA22BFCD5E36067BFE1CA5751F93BEA14
                                                                                                                                                                                                                                SHA-512:DCC93FC2F26A36BB76CF71932F3A596247127163ABF78305A68E19202101D6C08D2068382BD16B8C457FD1F8FF599EFD6035EBB1015FDB1E8C33999BA21E94D4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.699256605829205
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt958gNYqYbiFylX2HfYEZKdtFiA3kDww2/XOma1xO2Mfau1IrtH:2ZDvtntW7HBa1xO2MfauKrtH
                                                                                                                                                                                                                                MD5:85A947A983CB7B0BC629E4F6F0B6A386
                                                                                                                                                                                                                                SHA1:DEDFA2245167B2FCB65118CAD7B7F816A1A45904
                                                                                                                                                                                                                                SHA-256:078ADF3CE48DCF3FFE9A22B331454BA49FD5EAFFD63D9FB2F38FB5A26C9A52D2
                                                                                                                                                                                                                                SHA-512:BF2738319F1B5112E285544B6435908BB664445DD1835B4D95E01D589EC84FD5DE9A0894FEA340A784E49C0A45BA04CDEF91331DB3E269D927132944D3329044
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B3.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94768
                                                                                                                                                                                                                                Entropy (8bit):3.089228426475378
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:YICBFq3+JUbLvopN9s/79pZ0ocA6REXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x:YICBFq3+JUbLvopN9s/79pZ0ocA6REXZ
                                                                                                                                                                                                                                MD5:BDBD863C3B1913AC0C5C47F75A380AB2
                                                                                                                                                                                                                                SHA1:33E824A61E3A687DF6681035E76DC4789E2177FE
                                                                                                                                                                                                                                SHA-256:071E14FD182215D00DB40ACCEE565BE15B0995F011D12837A35D79C78082326A
                                                                                                                                                                                                                                SHA-512:F2892573D9A994E63D2E42C0419D3AA440837CF56A253A3F6E0DB485584729911E9FC3FBBF38EE1B11910DDDEC82899033424769ECB5D8ADEACFC29FB5AB7C3F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CBB.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95316
                                                                                                                                                                                                                                Entropy (8bit):3.0887281129616517
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:FswHbq3fKVfcQYuM0DvL5UKZL+cAHQ9Xxaq+x736+b+X+3+Z+2+3evg+DU+5+3LH:FswHbq3fKVfcQYuM0DvL5UKZL+cAHQ9E
                                                                                                                                                                                                                                MD5:E648B32FBC3D1A946FE9522A4425EF23
                                                                                                                                                                                                                                SHA1:9C6DAFF5B5CA4D11D8DC41A07917CD7342681773
                                                                                                                                                                                                                                SHA-256:D2799865E169D817EE0E65E1FB29B23240F2CB0B134B97A6BFA7499A0B9EA003
                                                                                                                                                                                                                                SHA-512:CD9102E9845832E38C22FD0E37D9FE8DD6AE6E77B96DD6486B258385506AFCEB2FF8A6D200D887B561B2520479CF96DEB0C1502CE3944B556CEFD8CEA9D90837
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DF4.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.699886358641075
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvthPcA2mY7YUFXvH8YEZRetFiH3lKD+wD5sBauxrMCucI2tH:2ZDvtmm8iweauxrMCub2tH
                                                                                                                                                                                                                                MD5:D600C8D9DB22D2EA0D1F9375F81F26CB
                                                                                                                                                                                                                                SHA1:B8F966F71956AAF4F40F74EEDC3B88E218E32DF2
                                                                                                                                                                                                                                SHA-256:0C52ECD213CDE24258485141BDE950840F865EF8D2E743618A1614760EA7E937
                                                                                                                                                                                                                                SHA-512:95F63E53D45D9DF97C830FCA7600B4E21CA9DF982B20C8B5D07350F09F4BDF51ABF6C125FDB4D0447A1239BFA5E9C1E1A815E50C45D8049599EDA099CE985100
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER278A.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94908
                                                                                                                                                                                                                                Entropy (8bit):3.0895846206734894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:kdjnOa3HKQ/odt+YuMy2fvL5UKZLPcAH+pXxaq+x736+b+X+3+Z+2+3evg+DU+53:kdjnOa3HKQ/odt+YuMy2fvL5UKZLPcA6
                                                                                                                                                                                                                                MD5:C9A7555D8448BF765D22290D5BE0F4F3
                                                                                                                                                                                                                                SHA1:71EDD4FC8003615D16CBAD1D07E60FEA3913BCCA
                                                                                                                                                                                                                                SHA-256:D352141FE4F5B9C3BDD75398B89B1C1846192E19D74F64B10906E78A9A579FF1
                                                                                                                                                                                                                                SHA-512:81BC567728B5AA77FAB940100209B755D7E90D92134B03D0C2BE77A3E3AE1B9E0EFDBCB96E41F0C32ED4014A8C9391B7830C505428960F0C310CCBBE5C17DD00
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER2912.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6993854432376696
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtbpV/tAaYWYNJFy+uH0YEZsKtFiY3MDXw4Yx1ITaO2xeMOuJITtH:2ZDvtFBCgqqaBxeMOu2TtH
                                                                                                                                                                                                                                MD5:A101713F5DED76DEF01799108FF19B2F
                                                                                                                                                                                                                                SHA1:A9D570D2DED42437C1FE1F9E14E89FB868B13DB6
                                                                                                                                                                                                                                SHA-256:B73A67B680D8DC213B6942AE552F422BC3BC5A8B7E27C588461FA839045A7082
                                                                                                                                                                                                                                SHA-512:EB81F926EA7326D55920712300B8E910DC84B5AD1226CBF8971AD83D0D68AD907D75B6EE1E64566E7881E69AB31EFA168A06C0D11101298BF9797C6249EE5F33
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E72.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95360
                                                                                                                                                                                                                                Entropy (8bit):3.0892263299761327
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:rvPpH3b9vGdwJdY8MNkvLpKZL8cAHMVXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L9:rvPpH3b9vGdwJdY8MNkvLpKZL8cAHMV6
                                                                                                                                                                                                                                MD5:5F58C8A13DADE5DEF9FD34758ADBAB00
                                                                                                                                                                                                                                SHA1:968D39BBD19DF697A11297B3A7DE6D696AB8FC42
                                                                                                                                                                                                                                SHA-256:6BE9224C5BD35FD385389737E99B9ED069D63E753E6FC7ED6507319E908F3D89
                                                                                                                                                                                                                                SHA-512:BB3D2EF20130A704D393B5B054757B313DEFA4DBC8542788474019F199D7A011EF020FF4F1B6323EDCF187122BFA25E480D3E7D8765BC30A11DD68A4A30DCAD8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F8C.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.699582585374873
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt5THKbhgYmYkDgFxPDHWYEZs/KtFii3KDLwXNS2a4xqKYMaumZI1tH:2ZDvt5TRHaPtaRa4xqKYMaumG1tH
                                                                                                                                                                                                                                MD5:B870BFD192DA21AE628542E47DE5E3C4
                                                                                                                                                                                                                                SHA1:11F11A0ED3CE8286B0A9A031B99F9A1AEF472828
                                                                                                                                                                                                                                SHA-256:9462792CB62717BE98217C952792E811C43B1447AB1890C0E921DF37A403EB25
                                                                                                                                                                                                                                SHA-512:013D5A74D12D56FA5535043EE2114D3B177B7A135E3B593BA3794A2BB3A4D92EBBBB2AEE0D0E1B9B9100EC842004A7343478ED25BC0DA3AA48FC39CDA9CA9090
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER359.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6978835403683665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtmY8jMAuYsY4FYHWYEZp7tFi03rDSwg+xaXxQWm9mMDQuWIhtH:2ZDvtjH7DoOaXxQWmsMsuRhtH
                                                                                                                                                                                                                                MD5:33E0CBCD05B58F4E16179C64EFBBFCFB
                                                                                                                                                                                                                                SHA1:ECAD76FF06D05B04899F46D5F5CAE137CD9791D4
                                                                                                                                                                                                                                SHA-256:53F7AE18835AD9F64D451D59276077E227564C2CC6496265418BDE7B58CAB833
                                                                                                                                                                                                                                SHA-512:DC9657C9A2C0393197F55EA752DA72E40F1512F390F345638E0EC829C183AE0A4B1FB7E06B10FDAF5DB7091EDF5277E4FFA326C0C8F3B200CF1942ABC4F66A4A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER3CCC.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):97010
                                                                                                                                                                                                                                Entropy (8bit):3.085730922940639
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:4tgb9C3LAXuicFY+M0UvLwK7YqcA2HXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+D:4tgb9C3LAXuicFY+M0UvLwK7YqcA2HXr
                                                                                                                                                                                                                                MD5:EBB4E409C2A61BC2520B5D8D2F4DEF35
                                                                                                                                                                                                                                SHA1:37EC6F4287405F697964A105F64005368AE9CF07
                                                                                                                                                                                                                                SHA-256:89EC3664B2B48C785B436D0B38280DCC459B4905467884BBE2C552AA850484BA
                                                                                                                                                                                                                                SHA-512:3CA3D4574A88319EC3C13365DA8653C3D70BA2D879169CC3D361E0C1EEE2D46EB5BF534A5EC4CE8D91CED61A5A7C188FEBACC53D63D52902FABCA739D8E72465
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D98.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6997112534871577
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtWmN1GYpYT1FRHPYEZLatFii3BDLwGdp4MkYa3xtMtubI8tH:2ZDvteeq+dtJa3xtMtuU8tH
                                                                                                                                                                                                                                MD5:7CD02F3385F051968EA0A61B0AA9D0F4
                                                                                                                                                                                                                                SHA1:B17ED1727BF12499076E6715B181BA77BDF83D81
                                                                                                                                                                                                                                SHA-256:C11F14C0831A997EE02770E76EEF6D75F0D9832AF73FAF7D40A4E9A6DA40F72C
                                                                                                                                                                                                                                SHA-512:3D1D019968AA69AE2A038E5060E7DC7B8A6CF815F54A050701A569B5BA31C85848517028B648B2319F1EE65657F35ADAEF04E2192BB3E1F95E2FB6DA4F14625B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E7.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95890
                                                                                                                                                                                                                                Entropy (8bit):3.0875019520522065
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:+VoZD0q3xkY3voPEjs/79pZLocA6AEXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+v:+VoZD0q3xkY3voPEjs/79pZLocA6AEX3
                                                                                                                                                                                                                                MD5:5C5AC641BD7BC1361B2856B2A7357CD1
                                                                                                                                                                                                                                SHA1:F01F861CC9F2F55214AA216018B1C0D108F33DE7
                                                                                                                                                                                                                                SHA-256:F36C610FA5F5EF1A73B8CA0B830EA9AD2F6ABA01EFE41BF6595B7DD1B1AD9B27
                                                                                                                                                                                                                                SHA-512:A79D28D2B1E278F12377675C1EE15DEA765D95B8B5532D66D0ACD49F2DA924BFEEFB64A6CFA9EA5279CAF0752DDD28391BF532969C987AA2248B17A5EB20DF0C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4087.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96248
                                                                                                                                                                                                                                Entropy (8bit):3.08587945847664
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:VPt5j3J5e/AT7Y+MFqvLwKuYqcAmHXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x/:VPt5j3J5e/AT7Y+MFqvLwKuYqcAmHXxH
                                                                                                                                                                                                                                MD5:C0D8828B8739E198F02DBCFF862B00AC
                                                                                                                                                                                                                                SHA1:832D29F8494A239C11DBB6DE56551471C694D7F0
                                                                                                                                                                                                                                SHA-256:69B48B7C48C6DAAEEFABBD465700FC86CB271CF2724AC33717127ACA34418200
                                                                                                                                                                                                                                SHA-512:2C1F4B692DD703350BF0B0AD8B5F535DB855490D85F46BF40FC2C94656412A9E53EE901F40069F8A0DF5D57B7A5E3AE5994F2C71F8D27EEC4C0B286F30D5E727
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER41C1.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6995971676090575
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtlTuTvCYBYVQFEHuYEZfrtFiw3dDAwydRAaGx8MqujIBtH:2ZDvtlT2DGdGaGx8MqusBtH
                                                                                                                                                                                                                                MD5:CEFC75D22AF28ED71820339E6C4E2828
                                                                                                                                                                                                                                SHA1:EDA3D18604F44E2B55AB877F606EB265F1976DA8
                                                                                                                                                                                                                                SHA-256:6884C8A53031641CA054F879E9246599D889B60A1601CF1419918BB03E969FDA
                                                                                                                                                                                                                                SHA-512:E7F7B45F8ED51CD92D209F1FDDB245A78EEB6B08BDE6DCCD3DF6174C51C649A6230873C5D37542849573CF04A3708F232C27F89AFC2A20CD06F2B4AFAD018C6A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4348.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):97054
                                                                                                                                                                                                                                Entropy (8bit):3.0855712168551452
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:zPuy3J5Mzbm7Y+MZgvLwKnYJcAbhXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+s:zPuy3J5Mzbm7Y+MZgvLwKnYJcAbhXxaA
                                                                                                                                                                                                                                MD5:C283FE748CC59B7FD8BE9CB641631FCE
                                                                                                                                                                                                                                SHA1:15E94B4D2FC5EF0ADE2A1F78997905DFC15CC09A
                                                                                                                                                                                                                                SHA-256:C5347731097786DDF783802F6B91BD5443357C024BE29955091A4E7DE03A09ED
                                                                                                                                                                                                                                SHA-512:048B4D6F2DF422663F179AD6242E1E1FEFF4A3C999232CBA57EC02E7CD259CE1DB77288AD2452F2F9F1A9E65623C7EBD3806234D6FDDF0FB3430F7350B27CA7D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER43E5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6992763682970824
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtW5LUfYPYiFIH+YEZTLtFir3nDwwFvMCIDa7xbMMTu4Is+tH:2ZDvtNIzSfIDa7xIMTufVtH
                                                                                                                                                                                                                                MD5:E0A85459754A7C5C7799322E2E31E5F6
                                                                                                                                                                                                                                SHA1:1A543D0FE75DA37494DA8D719D316870172A58C2
                                                                                                                                                                                                                                SHA-256:29765146274F1D581FDE39C090ADD4A01F78DB3B3EA622157F9715885961F484
                                                                                                                                                                                                                                SHA-512:5256B7F69A46829C95DEA8515E856B2C4B433656B08BD16B7C235150D4C990F65DC947A7705DA3BE686F2351CA05D07D92F30D4E35626752A0F81B2E94F0BA70
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER45F9.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):93126
                                                                                                                                                                                                                                Entropy (8bit):3.0959627741940037
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:vl4O5cS6Q07IiY3IbYgKVOxmnhCR4vnLvXy+k+4++YjvT+i+b+3X+L+K+DY0rR/0:vl4O5cS6Q07IiY3IbYgKVOxmnhCR4vnc
                                                                                                                                                                                                                                MD5:8A78E197BF0D5DD1083AD5703096FA36
                                                                                                                                                                                                                                SHA1:EF223A77A9116F43CAC79801D0D2B696D1B415B9
                                                                                                                                                                                                                                SHA-256:D338BC9407AFB856E6A23ABAEBD0DC085EAE61003C743861821DD40C767630F6
                                                                                                                                                                                                                                SHA-512:6A714BE5A2CB20C44B2038D4C7C4900F858D12CB729B9AA0234D8E53F3A5C9FC9BEC0A9C66468D297BB556B7D6B07688671C9412E8D430630727439F469F098A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4609.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96596
                                                                                                                                                                                                                                Entropy (8bit):3.0859864764125917
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:rb9Bm3epXyOR7YKQgvLwKfYl3nwhXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+X:rb9Bm3epXyOR7YKQgvLwKfYl3nwhXxaL
                                                                                                                                                                                                                                MD5:55846D705CCC0990D1ADD540B66A4D7A
                                                                                                                                                                                                                                SHA1:722B0F83E5D1F64F8206B7E5F190DCCE884CE09D
                                                                                                                                                                                                                                SHA-256:E18FC976718B66638C8FE9ACCE2287443929EF654D95B1E1E5032A39852EA28F
                                                                                                                                                                                                                                SHA-512:3EE84B46E63AF1618A4E0ABF2C95D7D6129685D5C3C0F4BCB449ACAF3A9CF5B514B200329DA603BA4731ABDEFE0D36D76865A051E2F3C398C46EC7A0BA638A4A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER46A7.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.699369049826022
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtjmTHb6YgYJFoHQnYEZOAtFiA3ODYwDO2laBlxkMLu1IatH:2ZDvtjD3ZLdajxkMLuKatH
                                                                                                                                                                                                                                MD5:CEE36859C5AA799907013D348B110ED4
                                                                                                                                                                                                                                SHA1:6C4B470CF7976F0EAE1A57A3406A13F4ADB86228
                                                                                                                                                                                                                                SHA-256:98315CA7C53283D3727DBB3A405EA7C7A54A4CC3A9C2C4B8702DED7C173566E8
                                                                                                                                                                                                                                SHA-512:798561D7050CB76EE43CD75754D34A841475B6781E41F8E4228838F3BED016A1ECF346958D439EDD90184963E3AE0FC53E0123D8A2097E8346CC91218A734DC9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4752.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.685190235202953
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt7bhCsAYiY+NBWhxVHSYEZxutFiIz3D6lewNPdaSZwpMOVZIX03:2ZDvtHilt4gH3FaSZwpMOVGX03
                                                                                                                                                                                                                                MD5:FC9C316B6EF6EF1113DBDDBB67286DB1
                                                                                                                                                                                                                                SHA1:1DF6E5FECB03765D011DBF50ECA19B25743160BE
                                                                                                                                                                                                                                SHA-256:3DB2D199C137C999BD1EFAA55135D30B050209C1EC494904E1709EBF05B5AC24
                                                                                                                                                                                                                                SHA-512:4F2F7042BE2866868A7119933B38773654209504909F0F32E8A764EF944676C404ACF57755FC3D9AEC76BD15F89744423286BE75F29F5201B5C9094270D38F99
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A4.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.698448614331966
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtNh9XUY/YnF3HWYEZQa3tFiv3lDSwiMya6x5Mvu3IctH:2ZDvtSY5RDa6x5MvuYctH
                                                                                                                                                                                                                                MD5:76EA8B6F106192FE9D420ADC16506B86
                                                                                                                                                                                                                                SHA1:5B70E599E13578D941E9883E38FC7B07C5AFC4BF
                                                                                                                                                                                                                                SHA-256:FB22171A8C236358B3DF2931FC7C5F55BCB43850A90B71928A30EA263AC1E7C4
                                                                                                                                                                                                                                SHA-512:4122D012F8B3E156119485971317662FE84C19951E859A7722C49D9DB9C492C6F1A7A0BFB17D61C161FD2A6FCB4AAB3383A387A9D14D9C3301DDAC67AE7E8742
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BD7.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):93112
                                                                                                                                                                                                                                Entropy (8bit):3.0963386523483276
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:wnuObVOyZR0N07lldpIbY+q6txm5xJ4enLvXy+k+4++YjvT+i+b+3X+L+K+YwMuE:wnuObVOyZR0N07lldpIbY+q6txm5xJ4v
                                                                                                                                                                                                                                MD5:BAD255042863F7EAD03902A6C4A343F0
                                                                                                                                                                                                                                SHA1:0BB7B3251DC8E0B80A0C9D16863B10F53FFE7B2A
                                                                                                                                                                                                                                SHA-256:B76498308453F8879128E9F773A5481E7146E5B1F9F8B8A6AAADA73836C8584D
                                                                                                                                                                                                                                SHA-512:EC8388B9CD72BF8F946C5051D75D1014363FB9504493906D94F72CDEC0C922CE3A67B01394B7AB31386BE8E6E1F7F13D8A7013031AB412DBC8CB46F54E9C12B9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C45.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):97502
                                                                                                                                                                                                                                Entropy (8bit):3.084462128668443
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:NEwd4N3dXXXlR7YK+KvLwKfYl3dreXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+xn:NEwd4N3dXXXlR7YK+KvLwKfYl3dreXxP
                                                                                                                                                                                                                                MD5:2CFC26ECD50BF59F6DC73E5D0B360AF8
                                                                                                                                                                                                                                SHA1:33C960D604D0ACEC5DC4CC524BD2500E5770F9FE
                                                                                                                                                                                                                                SHA-256:DBD9113C52A7168FF76AE729DFF87326CA9C82440519548994F552451129A880
                                                                                                                                                                                                                                SHA-512:EF0248779DFE63138257FE0B212F4339A04854AE3403108FDB1867CC83CFA9D915BA622C45ED3A479B47F226E44C17624D70379E8116890DD313982796D53D45
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D40.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7000726494249574
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtQYo4QnYFY+FoEHQNYEZS9tFih35DcwuaQlvFTsoaBDxfMKuLITtH:2ZDvtQlSkOSQ1alxfMKuETtH
                                                                                                                                                                                                                                MD5:315467640CA9D539A0FB84896E043CED
                                                                                                                                                                                                                                SHA1:8608613ADBB227876F72D405DCFD2926582FC186
                                                                                                                                                                                                                                SHA-256:35D559C39A73DFEB57865761AF99AF4587A619B18069527543EF225490044F8D
                                                                                                                                                                                                                                SHA-512:AD833558527813EF27DF1283FD39CA4D1B033225226D96A36F5D3C7337F340893E45A4A084A95D60056304651184FF629CB5C393B3C215F57701A7E15686ACB1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB2.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):97086
                                                                                                                                                                                                                                Entropy (8bit):3.0857164374970405
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:tOwIjhegYpuBMIpKDIvLwKV8YR3d4ZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+U:tOwIjhegYpuBMIpKDIvLwKV8YR3d4ZXM
                                                                                                                                                                                                                                MD5:5A91B4E2B62B298E360D768C92C688AC
                                                                                                                                                                                                                                SHA1:982138000B9E30778A56BC2AFFC31097C8519474
                                                                                                                                                                                                                                SHA-256:2501C916FB05F2EAF9260DDE302A5B49A752D32CF51D8116AF81948468EBB5B5
                                                                                                                                                                                                                                SHA-512:5F66CF46F6C13088505B86B0274BE8BB0E3A0CF5E89C22A4BB7B3E5BECDE7AB88DC584886041F26169EA719A5664BC31ACC57A99A37768EA937C6388CA9110F5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER507B.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.684848314181784
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtpctKDMYqcDYWWunHBYEZ+vZtFiu3+6KewpI5BM2+kaaxgMbuGIZt3:2ZDvtpETcDKvQTxKaaxgMbuBZt3
                                                                                                                                                                                                                                MD5:F1BDA0FC206E2BE005FC10233EB7A582
                                                                                                                                                                                                                                SHA1:E9476F11AD920B2E3E9C15E54C9B05BDAC39B7A3
                                                                                                                                                                                                                                SHA-256:B9A0357AA0F24E5E12DEC40FE3F9C648E300F04B56F8B16FBD6D0304002D2DF0
                                                                                                                                                                                                                                SHA-512:60E33AD10D161315EE74322773054294F32C12CCE6990C2A11ECA87C821DE5B26F25410A5B4031C7AF4D7E243F119113F82EA1C0A3C76F620F37EFB2330EFE57
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5159.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95976
                                                                                                                                                                                                                                Entropy (8bit):3.087266946916079
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:m0wIFTegYMjFxbKDIvLwKV8YR3d4PXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+xo:m0wIFTegYMjFxbKDIvLwKV8YR3d4PXxA
                                                                                                                                                                                                                                MD5:6D0C0570B162B3E8D38B7075E469AC21
                                                                                                                                                                                                                                SHA1:0093D835ED5F56CF2C340DD3037CD54F0AA7F7A1
                                                                                                                                                                                                                                SHA-256:DA4400C4B22004ECAD32C277E9B641622C370F8FF70AD7BEE9A7AB53A6D7827F
                                                                                                                                                                                                                                SHA-512:CABD3538D6B68F98323AA31B71D209E2B098B069F9E032CD6240F703767791BCCE9EF2EBE87557BB5A9E5D20FF26065B1A5C68DF1EF83032942B40810ADC32A6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5215.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6998670784384404
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtVa1BgYRYoFZHQlYEZhstFii3oDow+2kaZxEMpu4IqtH:2ZDvtrGW2jaZxEMpufqtH
                                                                                                                                                                                                                                MD5:4940D0D052EDF31EEF07EB078A25AC57
                                                                                                                                                                                                                                SHA1:5484EEB519BF5ABBF785DFB326D5AD4D0A1AEDED
                                                                                                                                                                                                                                SHA-256:9D9434DFFEB8B7AF02D030676E190BFCF2F28D32337CDC4F0687F2E68526AEF3
                                                                                                                                                                                                                                SHA-512:E16BBF9B53C5316BBE63E08A5161D6A441D1FDF688F931E2F5693754EFF47945C0D2CFBFB59B7673632843DFC60FFFED2D82D3468A022BB8B560889155164913
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5216.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6997739325460306
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt+a3lxpGYFYyxF2HQlYEZTVtFia3oDowY2wa0cx0M/u4IstH:2ZDvtbsyFNDna0cx0M/ufstH
                                                                                                                                                                                                                                MD5:2754157366DCFD872E6C39B057924AE0
                                                                                                                                                                                                                                SHA1:7DFD3E42C37377F5F7C69DB874C4734E93E098DE
                                                                                                                                                                                                                                SHA-256:63FC5C4B14D3BC3AE4E3ABE20BE4093CB726FB09A165450B1DDBC4356C0CF6F9
                                                                                                                                                                                                                                SHA-512:6A150584E9E7C4A78EA9B9C5F5F0057AB4DCF6AD8B3AF678A7EE9C1DBD4E5F916360A3CFA4352B111A79A26060FD5448E9FD3D739E0D40A6A098A98F91C36B52
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E1E.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98568
                                                                                                                                                                                                                                Entropy (8bit):3.083916002753022
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:8WwKG9jox5RevhUV75wmpVYJRBQoXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+G:8
                                                                                                                                                                                                                                MD5:87752C62A2B1C7E2AABD136E3DE12A75
                                                                                                                                                                                                                                SHA1:924829F50D3644642225B05D7CD8B04EFA8AF3F8
                                                                                                                                                                                                                                SHA-256:B65A02165B7ECB07DF45BD130FB0C60EF4DC112AD377130A97629686A0CE2446
                                                                                                                                                                                                                                SHA-512:D64FBDEC8E4F95A75945A1CAAE0C912B21175E3C9D72A9DC05A550B85238F1FC363BF22E534C7065D9B324629079A5B459FB1F039462F1004ADB7E396B009402
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5ECA.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98614
                                                                                                                                                                                                                                Entropy (8bit):3.083849423957178
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:uWwlaGjox5RF4hY/VJ5wxYJRBVoXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+jL:/
                                                                                                                                                                                                                                MD5:0CD4D62BBF970389AE180CA1B67277A9
                                                                                                                                                                                                                                SHA1:7F223B592A60FA19D4DA8902B874D2A2B9268899
                                                                                                                                                                                                                                SHA-256:2F65E994A86034F0F2A7A2891D568448A1090027496A18D24AF729C1E83C05C1
                                                                                                                                                                                                                                SHA-512:40D1E5274C347CF0CDCF4C853AB6FEB62EE9046CBD1A2B9E9B52B05A979BB59BB23FF099AD32A8253742E8043ECC8ABF2AD126545FEA898F91B2EE150DE29CE1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FC5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6998838897986857
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtd/1PjOYwY1F3H1/YEZCKtFiOC3qcDSw6lkXSjaCxXMt1uZI8tH:2ZDvtSXqcMkwaCxXMXuG8tH
                                                                                                                                                                                                                                MD5:7071C52A001751EF18F3E973D013D110
                                                                                                                                                                                                                                SHA1:560CB77F33CD5BFD02C1E3C9AEE26BEE52977BF3
                                                                                                                                                                                                                                SHA-256:EA9F3ADEB687314EAD9ABC171DD7DC9D4F23A773A6F707241AE9EECB4B7FA273
                                                                                                                                                                                                                                SHA-512:D9A70D949EBD4F95D8CAFAA998DEAAC5C906CF11C1917A8814D2E41A3020E21D0424219389471D8E47FED361770A8D832E361479D9940AE8DFCB1158837D903C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER613D.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.700395447617891
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt+4QCZLOYaYNFbH1YEZnXztFiL3YD/wplNQaRxdMTu3ImtH:2ZDvtqptqX8CaRxdMTuYmtH
                                                                                                                                                                                                                                MD5:B953C616E285CC32BB219652D6998D9E
                                                                                                                                                                                                                                SHA1:3CCCCC46806E8D942A69F5E9DE92A101A7E31299
                                                                                                                                                                                                                                SHA-256:ABC28A3639EB205DD285040B14F0EC089020CFFE4DB4958E026C38809B768850
                                                                                                                                                                                                                                SHA-512:803331855B0C898E3C93D950B4D05F7D93D534F8FD1B7F003A04DAB16ECE63FC2C56A441C9E22F95BCF48F88A3D6D5CA087AF3EFC80E9E06270EDC2F03120AAE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER6277.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98986
                                                                                                                                                                                                                                Entropy (8bit):3.0827382795997025
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:jyFw/CujoxLRh40VJ5wXYdRBV+Xxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+j+1:p
                                                                                                                                                                                                                                MD5:674B086F833A906762BCABD49B9BF361
                                                                                                                                                                                                                                SHA1:9FB8C8FD5FC50A8CB2B1A079A9C0C4593C443384
                                                                                                                                                                                                                                SHA-256:110510C498F740EEE6D08507885C35E8C386F373F6232BEB4F6BCC4D2896A10F
                                                                                                                                                                                                                                SHA-512:37847E7CDDC489C1ABE77E52D3E346F4EFBDDC451C9196AE53F14D236BBA1D811B1B7D3F3FADC96511FE991B96D27E9922EAE895206ED0F89DC43D115798B47E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER647C.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.699824419857966
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtqQeP/DvYvYMFEHpYEZmatFi73ODUwUFtaPxAM1uSNI2tH:2ZDvtKDoTX3aPxAM1uX2tH
                                                                                                                                                                                                                                MD5:FC368D1C92A29F3CA8A5E66AAA8FA374
                                                                                                                                                                                                                                SHA1:DBF252A11C5F24D258F9C7A9DE386B1CC07ABE27
                                                                                                                                                                                                                                SHA-256:22038264281C7F8C5C8E300235217504431F6DCF545AFCCEDA3DDF86A3C2A1B0
                                                                                                                                                                                                                                SHA-512:17842D41075935DEC5EDDF2B8AAEBEB7FECE04985252A271EE569348678970FDC458B92FA578163B5BD327E967B06159FA713CF7090B1CA6618844B44A7F82C5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B62.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100136
                                                                                                                                                                                                                                Entropy (8bit):3.082750530431706
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:h0UbwSz4rotqCSQ7IVJ5wXYnR21EXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+A:Q
                                                                                                                                                                                                                                MD5:91835E4CD3D44F5E1935788883CB6D37
                                                                                                                                                                                                                                SHA1:908F1CFE3A4668B1E9C755561313F4B45F221987
                                                                                                                                                                                                                                SHA-256:E9AF04791B566947FF6CA958E19251DF02E3C5DA55E54EA0411AC4ACFB41343D
                                                                                                                                                                                                                                SHA-512:E742736B66F241ECDC8D80F9E62EF89A4663808955311BC5FFB87F4B27CDCA90A8DB566C3D6254ADD505C33204A218EDF83EF6EF0DE07244E98CFC76690A1807
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BF0.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100154
                                                                                                                                                                                                                                Entropy (8bit):3.0826807348159937
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:gc05zwS44rotUluFyDVJ5wXYnR21EXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x1:I
                                                                                                                                                                                                                                MD5:72336C28A801AE674649679685B1B845
                                                                                                                                                                                                                                SHA1:0D0D55B7A56A7E609C2E9C87CECD252BC33949D2
                                                                                                                                                                                                                                SHA-256:3E864F01E2F1F766523FE5304DEB4679553D2ED1838AAF8C59385ED1CC0FC13C
                                                                                                                                                                                                                                SHA-512:CE9D0E2830D7C9A58F9331A43924DCC0C39186A284538393A9833574571F6F2FA7AB5E17702C15B97C0EC54C141B1D92EF55D650ADCE77E32917D7A3E61D7F7B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C9D.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7006668833084135
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtaUCYcqYjYYF8HsYEZ/dtFiCC3oDCwQ2SWavx+WM+uLIgtH:2ZDvtX0XgMavxfM+uEgtH
                                                                                                                                                                                                                                MD5:4792603B961B4E0383274B7B60EDF23F
                                                                                                                                                                                                                                SHA1:39DBB540755F4B734BA8A6D3A73CE0E61A404259
                                                                                                                                                                                                                                SHA-256:6971928A876CE427FFA9EB0E79FC319D086C65BD7E07130EAE3C25636E82D99F
                                                                                                                                                                                                                                SHA-512:A637B263CCA81E80FDC3611730DF64615BBEF0D598A31A3790D9975BFBBDB18859B2BFB041785799E4FF8B680C323705BE44B8F765C337647F913ECF90116874
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D69.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7002548454124597
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtZHV0n5YTYtFkiNHLYEZ2GtFiT3FDeweLSS7auxjM2u2IttH:2ZDvtw5ktS3auxjM2uxttH
                                                                                                                                                                                                                                MD5:D3C3B054EC707247B36E4E2398C0B482
                                                                                                                                                                                                                                SHA1:29B8D2176B108D76B23584143666CC394EAE394B
                                                                                                                                                                                                                                SHA-256:AEA0094A8FA199FDF5E381AB6CA75D8405646AA3C85D95AD35B04B521A620E65
                                                                                                                                                                                                                                SHA-512:1AB3B2C7A9241AE5FC861FE3FE48063C083772D60512975CDF63C5FECE0A3581A3C1307AD0C2860E7CB8F97E6A2F7B0D4501BFCFAB89AF7770EB8DBD36E42B5E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER750C.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94016
                                                                                                                                                                                                                                Entropy (8bit):3.0963022904264377
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:1+KB923TWIgNV69UYT6AaKjRmopuULvXy+k+4++YjvT+i+b+3X+L+K+nYYM3t1ID:1+KB923TWIgNV69UYT6AaKjRmopuULvb
                                                                                                                                                                                                                                MD5:29571F5EDD7E7772627C1A691AFA1C77
                                                                                                                                                                                                                                SHA1:9012DA1FBBBEB434645207EDB6CF0BF1FA0C7F45
                                                                                                                                                                                                                                SHA-256:01FF95256F05D1F48E208087034115E363F80C1C2B038A789A322CE8916B74B0
                                                                                                                                                                                                                                SHA-512:47777A298B0BBF27EC09415116B864A4F4511D11E862A27303815FFED4DF1C22DE5B2E3F5743741BC00A4B3A8894A56C5CF8C206B7E0532865B36CDB96074E3D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7559.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100802
                                                                                                                                                                                                                                Entropy (8bit):3.0826888119002303
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:h0TNwioV+VonHvs4w9NVVJ5wXYlR20EXxaq+x736+b+X+3+Z+2+3evg+DU+5+3La:z
                                                                                                                                                                                                                                MD5:4E139942CD10AB76AEDA7B8A80725A84
                                                                                                                                                                                                                                SHA1:3FA98F4A3C0E83F34DF32838EAAB2A6AFDF404DD
                                                                                                                                                                                                                                SHA-256:217BDFDFD14E3191B8B7C2D71B877C9CD80BDC4CE9DC258FFB53668C5C28B441
                                                                                                                                                                                                                                SHA-512:2BBE896DA9361EB920FFF733E6CB2FEEE8CDCFCCEDBAF17FB8C990605BE620C71FF5D5EABE5F42D0EEE2C2F6A1C7F1DC4E495900B89335AC47CA49E43AE958FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7664.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6997868866686088
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt90m+0aJXYRY5FpHrYEZp3tFiECEQDSwknOKaLxFMfulIptH:2ZDvt2NmAhOKaLxFMfu6ptH
                                                                                                                                                                                                                                MD5:C3CC76B8F0E41F76E126EC435BCD2744
                                                                                                                                                                                                                                SHA1:D5837BBCD3964D38CE7F05531C5D444148C01F74
                                                                                                                                                                                                                                SHA-256:B5639AF9C9D32A91350B08528AE82B6DB5B805BAD60B85C142C8FB5A6200A107
                                                                                                                                                                                                                                SHA-512:F840C92E1ACD44307D3A3C4302AFFB23F02C32CB5A8DAA73226160AD79E26CB4A13D85A3B49ABEA81A356BDC95FE43CF791F5C3A493E1AF079F3D31D3E0A5C1A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7ACA.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6940493908499046
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtMdbjKNlmzYeYgWJ0VH6YEZEZtFiS3Y6cgwDfpeahikxJMOu/I6td:2ZDvtMaW5B8DYahHxJMOuQ6td
                                                                                                                                                                                                                                MD5:F114F61584FCFF9F70FA7ACEB24E98A3
                                                                                                                                                                                                                                SHA1:4E501462B20448B7B5C0E6FA0BBD8D8689CB981E
                                                                                                                                                                                                                                SHA-256:459CB90D1B93D6544438A9726CAB87DAF9665E204B315CA65DFB2211040BAF3B
                                                                                                                                                                                                                                SHA-512:E303745C7D78D8D147A7337687A494295FCA1D73D6E3DDF116E57A17CDAC6EFB0E660165AA3D409DDB0276C979E611BF055ABCB0892CB2B286D94AB0722FAAFE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AF9.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99812
                                                                                                                                                                                                                                Entropy (8bit):3.0841413479935196
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:Ox4HwxXSxVonO2rNwMBfVX5wSYejRvEXxaq+x736+b+X+3+Z+2+3evg+DU+5+3Ly:f
                                                                                                                                                                                                                                MD5:3DD8AF6C1D931AE8EAEF88A3D906A6F3
                                                                                                                                                                                                                                SHA1:E5D55C8EB447C4821289CC33ED006A3D1F254520
                                                                                                                                                                                                                                SHA-256:1974E832A3C7E88D0D6864E0A7A8B34E187C1807BD8EB608823FF3678B5FADDE
                                                                                                                                                                                                                                SHA-512:8C7550932A29332B4A21C627C7E5C58E09A3C656BD7996AC67D9E5335C3A04EBF04BDB5B170B1BF204257B38752E0234EA341582C14205B9D3C5D476299F7493
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B77.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100550
                                                                                                                                                                                                                                Entropy (8bit):3.083129843910271
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:af3wxXKrVonOWqNwMBIVX5wSYenRvEXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+h:E
                                                                                                                                                                                                                                MD5:3C325B7D28BD193F748A598830E8CDA2
                                                                                                                                                                                                                                SHA1:4C310E6041D5B8764944CA534E2D8AA4E7BE07E6
                                                                                                                                                                                                                                SHA-256:A1C15BE9A17F8ED6A09BA8FF75075496F8AB95E29B9444F3D7212C16F6D3FA4A
                                                                                                                                                                                                                                SHA-512:9BDDC36B4CA35C427103CD0EA97E564B19ED05ACE5930867322D3D805CAEC94243366B889360F50AA446BA3A7FEBB5823CEE9B7A8A6842C3A20F476258857F1C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C04.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100198
                                                                                                                                                                                                                                Entropy (8bit):3.083560420127805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:dOGwxXEaVonOW1NwfBvVX5wSYenRvEXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+e:a
                                                                                                                                                                                                                                MD5:D6B77DD886C8A1FC3F4165680E1B61CA
                                                                                                                                                                                                                                SHA1:1E2BDAA450F58DDAAC65BEE29B0897D92AC3122C
                                                                                                                                                                                                                                SHA-256:F3684FF4CFD5510285527A381D3DD7B2D38DCD202C8A462DF17BBBB992A2EF1F
                                                                                                                                                                                                                                SHA-512:BEDCD1AD5963D580FF606F520DA0092BE94B6E9BC859C018D566F72AE278947BE2406405EDA7B7EE109D86D4365EAAC295A6B380FF99F331B250C96EF7FB5C2A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D0F.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7010210699990327
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtU/qeGbYhYIFzGHxYEZmYtFi3CE3DzwV1/Eazx/MGuLIr1tH:2ZDvtzmVxKWazx/MGuEJtH
                                                                                                                                                                                                                                MD5:6044D5CCBB11DD3010C1661773715600
                                                                                                                                                                                                                                SHA1:E7D43A872AD95F66DEC67985C47CA0C9065C0B54
                                                                                                                                                                                                                                SHA-256:D6299B5E88CDF4F1FDE81F03A49BA79EBAD898218E5586714ED5FA03DCFDD085
                                                                                                                                                                                                                                SHA-512:D3249838D6714CD16721919D18C5082A0DF70778C7F8D12C32330E4D29718FA73F99BE35380B0C37D5D795F9EF079A6DD292355D25FCA9F52F7F5EA4BF4D157F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D1F.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.700942910649609
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtf/m+0+yY5YbF5HxYEZnztFifE3Dzw8mP9R2axxBM4uLIrXtH:2ZDvthyOa/DaxxBM4uErtH
                                                                                                                                                                                                                                MD5:1D86214A9139B705B450691BBCBA92D6
                                                                                                                                                                                                                                SHA1:B96351EB2DE390E57251064F598BB215CD2CE777
                                                                                                                                                                                                                                SHA-256:574A822F2DBED3D0F3BE8CA2F003A723F2764A6780FA4FCA1E1459B73D214080
                                                                                                                                                                                                                                SHA-512:94390E0468D84D641E7FDF6584D71AF94F7250991C5CB6030E53329E4C62925C10EF83F62AD995014C388B461D56616B0A521AE05D5A28BBAFBAE0235B466D8C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D6F.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.700953581581921
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt+C14pwYMY6F4HrYEZWFtFinE3DrwCrs0aaxyMYukI3tH:2ZDvtX7bH7aaxyMYuT3tH
                                                                                                                                                                                                                                MD5:979D18765C638427478AA810431E378E
                                                                                                                                                                                                                                SHA1:A40AECAB05137EB8CF0971E84DE92EFE35619648
                                                                                                                                                                                                                                SHA-256:9D9A607738F8F6C1BA0C69910ED4EA25874EE448CF65886EB5C9F44E1B611EBE
                                                                                                                                                                                                                                SHA-512:26E32F329BC942F4C5FD551B2647DB472FBB098E0CD74A307ABD2A353AB3F197E4E7DF590B29B64D794CE135DA27EF1F76B0EAE10B9F3965C94323FC9DABF6B5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER81C5.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99396
                                                                                                                                                                                                                                Entropy (8bit):3.0841946432572143
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:lkbwVXsaPoHurEaXBLVX5wSYXnR3ZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+:P
                                                                                                                                                                                                                                MD5:2EDB5DEFB179E680CFECB14AB2535BDD
                                                                                                                                                                                                                                SHA1:4FAAF55A64D8B2E80EA48785D64373EE3A9E8607
                                                                                                                                                                                                                                SHA-256:655861C516F884FB6E167E2BD664822E939DE826922A0D163F0087EADB5FE0D4
                                                                                                                                                                                                                                SHA-512:2540B355265CECDEC4D1BF46E49940810E2E8E08D40B47DC0AA1A39D57B927A9902E85E9F6007872A7596A0EABAE60FFB213CCD37134F5F9D5AAFBC2DF7E4DB8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER82F8.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100820
                                                                                                                                                                                                                                Entropy (8bit):3.085707680282929
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:Tt4WWXKpe38u6cUYB2KLCXPcRrnp3l/LvXy+k+4++YjvT+i+b+3X+L+K+ApFAam5:c
                                                                                                                                                                                                                                MD5:3577B1E4C73B6323B08F83B58009CBE5
                                                                                                                                                                                                                                SHA1:68505D11CCBD96ACFAC6EB9408835CD197667F7D
                                                                                                                                                                                                                                SHA-256:19F057357739498494FDC363E61704FFD5ECEAF0A47E3B5BB98A823B4E3F649B
                                                                                                                                                                                                                                SHA-512:D3682D5FBFD53FF27E9A5BFE188C3CBD52B23D3E71BA768388B5E523FE267A6B2E94E36903DB8A1B00C2A484769EA060F2BEB246F3022E72E34F59A36A3C90ED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER83C4.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.694482537632726
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtYk+RAYiYFZW9VHnYEZ2OtFiq3LDhwIU8GakxCM6u9I3tx:2ZDvtL1IVMEakxCM6uC3tx
                                                                                                                                                                                                                                MD5:A16EA2415980643B2C1B46C5662E46C1
                                                                                                                                                                                                                                SHA1:04328CB00BC9CCA31DCD4D42EE9AF42FABA9EC9B
                                                                                                                                                                                                                                SHA-256:7A260D12BA8F04721B1CC64D0EA2618A1C54E67ADE1E37D70CCB1E7B2F4631B0
                                                                                                                                                                                                                                SHA-512:AF243611D53E8CFE12BD51A8BF52AB0D5B5B7BA115B3EED175E04C3D944E937649D1E6F2515EDD13777E85C8807CA15B9B4B1CB6E7647A27B8E30B4B5A7FD999
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER83D9.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7007504573798076
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtn07h6YaY0FlEH5YEZiitFiDEIDSwAejaRxUMEu4IOtH:2ZDvtjd1C8aRxUMEufOtH
                                                                                                                                                                                                                                MD5:AA409AA00387BF9C00587CF3D2233EC9
                                                                                                                                                                                                                                SHA1:08FF0DBEB3C5190BB497D8143AFEB18CF766B4C8
                                                                                                                                                                                                                                SHA-256:AD5A519221C067FDEC8B7C3B94EE2E34AF4F95AC5D2210FA2FB8F6E62402B6B9
                                                                                                                                                                                                                                SHA-512:938961FD674B3FC7E1138F03CB98EF62D556ED7CF79F8DA37065994B3295CEA4B3E884C54D26E676E583A5548A6E06372BD814515D26477C15A87C168089CC26
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER85D9.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99600
                                                                                                                                                                                                                                Entropy (8bit):3.086729720441057
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:UYeLWFWKpl280PUYB2KusXPcRrSp3lbLvXy+k+4++YjvT+i+b+3X+L+K+ip31kNY:7
                                                                                                                                                                                                                                MD5:02AB667074B4DAFB68996C13ECB62B47
                                                                                                                                                                                                                                SHA1:A3C7492CDAAACAAC7331DCF5A3DD1E7E5E8B5913
                                                                                                                                                                                                                                SHA-256:2BD68394903B027C79B2A10603B8DC5D273C9F52075E5225F7290B08BA2E0205
                                                                                                                                                                                                                                SHA-512:243CA32A7032D091C2165C7BD2A70447BB7BCEF6C53118F7099A55B7ED1D57DD6DF17C67B423296F509D23A1FA39CCE12313D9D5FA9380B1AED801D2E8A0C0DA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER8764.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99926
                                                                                                                                                                                                                                Entropy (8bit):3.0839420473683075
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:DsCEXfoPoJvrEfatmVX5w7IXnEZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+jC:6
                                                                                                                                                                                                                                MD5:D14A895F951F8935341668F02896E256
                                                                                                                                                                                                                                SHA1:B20F28CD1489690A567215CEBA30DF3D74E6B339
                                                                                                                                                                                                                                SHA-256:3939B6E6F2497274C3E27CEFD2F3208F37B557DB1A9C2C34C8B295B3C8092EFF
                                                                                                                                                                                                                                SHA-512:E14EBDEDC573D87DDD6CA673FFBCBA46FCBC08064EDC1390EB9B752FC512FBA2F42DC7F3120739C93D45FD78393C0682B6DBD5C3B641A6FC890E178215BD2530
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER88FC.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7009728392789847
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtn7xEzPYQ2YUFZHVYEZUAtFiuElD+wS97bamx3MSusINtH:2ZDvtnqV2c2damx3MSurNtH
                                                                                                                                                                                                                                MD5:A4149342039B6BAA874F8FDB1740BF69
                                                                                                                                                                                                                                SHA1:E8F258437E934E4B563A68581FF14C52128290DE
                                                                                                                                                                                                                                SHA-256:33F1D21667210F9322ADED9B09970409578C0B97FEA831D0C4A993724A4AD6C3
                                                                                                                                                                                                                                SHA-512:44822EAA691ED2E13AA1CECEE84EC25418ECB5D313BB16B33F502FF66F5382FBF0BE3720FB4A7F65EB3F981FF552B3FEBBFD9D71AD92E6DA0F62E0B521437F4D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER897A.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99966
                                                                                                                                                                                                                                Entropy (8bit):3.083713723849435
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:XKCEXRJPo7vrEzTt/Vt5w7mtnaZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+jB:A
                                                                                                                                                                                                                                MD5:DF08D33C9227BCD4B6B1C93D4F30659D
                                                                                                                                                                                                                                SHA1:5775D504BF04AE45EC275AF80BD611F833A29B41
                                                                                                                                                                                                                                SHA-256:F76A48555544650A6707DEECACF1061E23A1C477AA5B3ABC24104541C59A5287
                                                                                                                                                                                                                                SHA-512:1EF6B7EEC1D4AC4A2A1732F4A5928496C8631332FD446D5BE22747D891F99D3D3C1408CF4CCA87AF1ACC82AC1114953DA0DF2F5B3C835D3B15F133C68269D5E0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER89D1.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100432
                                                                                                                                                                                                                                Entropy (8bit):3.085539049987301
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:wYy8WkD9Kev28xiRYB2KSKXPcR6yp3lCLvXy+k+4++YjvT+i+b+3X+L+K+1pzUia:2
                                                                                                                                                                                                                                MD5:106893FF1937469B862066900FE08FFF
                                                                                                                                                                                                                                SHA1:34724647625599A88776096B65EBB912DD5D5A73
                                                                                                                                                                                                                                SHA-256:AF5B27740EBB8D0CB18FA3F2B59A01E1EBF4359E5C83FA4950E309F4704CC66C
                                                                                                                                                                                                                                SHA-512:7E15DEE8B2DDDD44B17354A3C8E38AEF74B6E097A08D7D524275A6731294A94F2D77D49AA6E6327BC23C5926E5A18380BE54EF2A0DD0AC33B8974D4062F8AF2E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A8E.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6945671866194094
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt+hh7PMmYcYRW0VHDYEZzSktFiM3VDDwtawaTxHMfuPIZtf:2ZDvt+LrcSxbaTxHMfugZtf
                                                                                                                                                                                                                                MD5:E7F991F6CC9349D98F69F0841FDAF8BE
                                                                                                                                                                                                                                SHA1:1136BC955E31ABFC27811E8F0BF516EC0D3A1C9A
                                                                                                                                                                                                                                SHA-256:79D45F3B3A3DFFAACC7529BA52C28F020CA4C7B10661CB99C63301DE353BF447
                                                                                                                                                                                                                                SHA-512:511F99660D88A8437035ED96BC7837D47B5CDBEA2644D6F4CD1D24C621D4EEFB0CFE501735438A53EBD2530DD33599DFC63B33CB176AD397505A28F5518F7614
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BD7.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6946468761963085
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvt00g2UEYzYzWhVHl9YEZEZtFiU3fDZwfCPa4xhM7uzIWtw:2ZDvtJtUTcssa4xhM7u8Wtw
                                                                                                                                                                                                                                MD5:4FC449D7055BF2FD5EDDCC6D02ED7F91
                                                                                                                                                                                                                                SHA1:2DF66C5C3CFE4C2472D494A711A2B2626C8426C0
                                                                                                                                                                                                                                SHA-256:B062435E84CAB17E074C18AD2ED6DC42DB11AA0D63C82F1204D3D56A9EE01908
                                                                                                                                                                                                                                SHA-512:6BEA58E3CFFDD7525D71F8FD4BB381A82AEBC44486CE3CBC182862B12170313BD7FAE7FD924508648D29A69F89EFD4CDAC04B1EEF453F9EC853524C8CDA65BED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C1B.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7008667904257178
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtN4CnRGY1Y8F1Y/H1YEZxNptFiLE0xDrwv+ivia4x8bMhuhIUtH:2ZDvtNSibY5NcEoa4xyMhueUtH
                                                                                                                                                                                                                                MD5:8DADEC847466EE899A7800AAB774C13A
                                                                                                                                                                                                                                SHA1:3A2F81E84B2B0FB9EADBC018F79A5C1F888F28C4
                                                                                                                                                                                                                                SHA-256:543D0F45D3748733C58A597C999B9563F3E9E53D7E901C4F5641E93F3EBB23C0
                                                                                                                                                                                                                                SHA-512:964E4B809786C76AF3F44F640DC483854B56B68E4238A9D550F75B4622B4C98D6F58A0ABC95BE5A45E9584D28530E0C941A9D33DE53A9878BCCDCFCF45AD0B98
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F33.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100820
                                                                                                                                                                                                                                Entropy (8bit):3.084241075547315
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:IOJWe8KJYQpQYBuKeobPcRGpSliLvXy+k+4++YjvT+i+b+3X+L+K+1V8R7ykCRB:R
                                                                                                                                                                                                                                MD5:3A7A9327138096FBE08C0256798975F3
                                                                                                                                                                                                                                SHA1:351F018448BB35EFA93E5BB90E6C4B102E215548
                                                                                                                                                                                                                                SHA-256:06C7B42B779E6ECCBAB0FB8CA61BB3E0A6653CAB1EF00E985728BA7C178A0B61
                                                                                                                                                                                                                                SHA-512:0FFD12BD5B17E4F64BDCB5601A505810BCAA1100E3359C2139082FECF3E0DF8077F043D74212CAE436C71C0388AE358EC2F305AAFA0EC112AC9784DA9ACA87FA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9167.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.694478703033035
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtbNcarcY9YTBW9aEH4YYEZSLtFim3PDS4jwyICanxOMMvuuI4tt:2ZDvtYay7Z/anxrMvu54tt
                                                                                                                                                                                                                                MD5:25178A70964C0DA91F0D9221D87675A9
                                                                                                                                                                                                                                SHA1:CC9FD06BD270D269ED3AE2972689B0B9714E3F0C
                                                                                                                                                                                                                                SHA-256:0C6B0783AF7421AFEC10229A0669E68E27C79E0B55D0B2ED481E63AA3A61706A
                                                                                                                                                                                                                                SHA-512:4700DA7B24AB84CF555C3B4395746AAEBD743DA900F4DBF6A8CF192DDCA8BE6E5D7B0AD406B1B6566DC6A740942D04847403E80D666D5CD6FDE9F7F49DF0659C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9705.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100240
                                                                                                                                                                                                                                Entropy (8bit):3.083322350409657
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:nAg0Cw4K8EozHYBis5s/mcRXp6l/XuCoQ+NLdjD+W+j+R+1+B++YjvT+i+b+3n+S:w
                                                                                                                                                                                                                                MD5:D151C614FB908B3A3C93CA69C521045D
                                                                                                                                                                                                                                SHA1:58417B13AF3B59FBD34E71E0E6EEB4BC655D7CCC
                                                                                                                                                                                                                                SHA-256:C4BA2A9C5C6242192F01E3A86F116F9839A7323DB39AC3750C44DED39DA60B25
                                                                                                                                                                                                                                SHA-512:5DD2E5BE847FC86B2257F9F7BBBB214F4DF1688801C96602DCA4C2F75F46A599A538A6AEE37292831D63FE018E451DDB424B8B838D5D69FDA6235EEA351288D7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER977.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95484
                                                                                                                                                                                                                                Entropy (8bit):3.0879963534663717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:zetrZI3xK7yvoeamQ3L79pZLGcA6t8Xxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+3:zetrZI3xK7yvoeamQ3L79pZLGcA6t8XP
                                                                                                                                                                                                                                MD5:E9A85DCA6037BA00A0B0315BF9668C2B
                                                                                                                                                                                                                                SHA1:2E33108810EEE40595BD6B95B30BB7F6D42B97DC
                                                                                                                                                                                                                                SHA-256:BB31114378BE0AD2932ECE359E7D64A44538C8A77B370BB77F8F3FC9BD2A41DF
                                                                                                                                                                                                                                SHA-512:320D024848D1B2E99528D8F8C118D56DB87AEF54929F987EDA5F7191950FA6B4134CDE4F539193D5191E5DE178B20993502449315CE992B00966F8495BC3ABF3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER98AE.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):103110
                                                                                                                                                                                                                                Entropy (8bit):3.08028378449835
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:RyrKXBqAo+MHaPQ/O/VtZw+mGnGKZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+xr:X
                                                                                                                                                                                                                                MD5:F914542AD238D4E1C5B74639F7A427E3
                                                                                                                                                                                                                                SHA1:88C25E0913FC10BE8F238480780A3372BC1DA838
                                                                                                                                                                                                                                SHA-256:823039EEBD1129F11AA67DF243AB9A541E087EE1C1DB36DA0F1AC0E5B494EA69
                                                                                                                                                                                                                                SHA-512:507E514090AAAA1747DA399267DFA1EEA497F5172C90D03315F918BF301747A560B8956BAC1E27C7B790C83ABFCCA7285C3EDF1AA9EDF927C6801144D3734118
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER99C5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6966992096005487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtlFVBIyYPYfyFpUEHZYEZPBtFil3jDSpwyeEUyt3aXx0k2Mh/umIntO:2ZDvtLookJaE13aXxH2Mh/uhntO
                                                                                                                                                                                                                                MD5:0D6CD3DF757AF48AEAE8EF90B832F555
                                                                                                                                                                                                                                SHA1:034AD695E276AFE8C7818A226B6CDF3F1E999C88
                                                                                                                                                                                                                                SHA-256:69663A3C77B7E93786F7BF8889A29B8748F8134608B7771FCA1B8CD28D40517C
                                                                                                                                                                                                                                SHA-512:796D753F70A62CB7B4B1F381D4029AA17992613B6095CF7AFE2037C9D716F00442FE003EE49BC5B23EB4F3279970972A8889AAFFE30EF1EAE4A74E6686EA59C7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AB3.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.700408204644083
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtJu5J2ImY2YqoNFvGHyYEZostFiKE9DcwB+05uamxxMPuXIMtH:2ZDvtxBjGKzYamxxMPu4MtH
                                                                                                                                                                                                                                MD5:93E1BAB435F00875EF33B7B06A00F381
                                                                                                                                                                                                                                SHA1:FE4188E775E65323549EB2A4F18C6662F55DD833
                                                                                                                                                                                                                                SHA-256:1FD1DBD4E55D739369076D7A5CB8A1C2784C95E60FD47D95FCAFB2BDD09269AE
                                                                                                                                                                                                                                SHA-512:AEF7BDE2E0CD98D14C012B8153236D09FB5BD01D065B3621F9303B62FC9DC11D96CD7C900BD723430F80E73C96181DC1D0ED4F552F7503CBA5A1F30B39C41F60
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B8F.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):103180
                                                                                                                                                                                                                                Entropy (8bit):3.0799757072216454
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:eDrHXhqAocnYaPT/RVtZw+mGnG1ZXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+9:c
                                                                                                                                                                                                                                MD5:0F1A0C6B1B18751B8C99E96D5E39AB63
                                                                                                                                                                                                                                SHA1:186C497809BD323342E9A686598C8104781EA8C8
                                                                                                                                                                                                                                SHA-256:6345E0572340B46F9D585036BB3BEF22AFFB523C00BAF7803A3C6FD43DF1116E
                                                                                                                                                                                                                                SHA-512:C71C8317B4908C56456DA836F43654D4180CE1D1F4F1E00C7C7FCC75CF11A85ED308EB74C79BDF5EE102FA6198D76D3821DA7460436A51CB9C0D9044CDA81963
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DED.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):100308
                                                                                                                                                                                                                                Entropy (8bit):3.0830572502074935
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:/Xw021hKKkt5tLOvLtPbzQgWp6lsXuCoQ+NLdjD+W+j+R+1+B++YjvT+i+b+3n+/:o
                                                                                                                                                                                                                                MD5:EE9DF88E7EE795F18FD9D5705ADF0E11
                                                                                                                                                                                                                                SHA1:D6B6724AC092313814675B6FC3F70712C48A17CA
                                                                                                                                                                                                                                SHA-256:E4529F5AA62DCC431A499FC87A89840360BB5605E27AA0D811F6A7EA8D1FBECC
                                                                                                                                                                                                                                SHA-512:D47D2265FA5E3BB2242E7DD74100F523BB3CEAC6FA4E2AE6F3B419CAC578E52424FE3D627FF65F5F972CDB08B3CFEE52EC8C5ED9262BB362C7634D371EDFC198
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E4F.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.7006118457342896
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtrYOgP1Yy2Y6F0HKYEZP22tFiHEpD+wuxCEasxlMOucIhtH:2ZDvtQF2X2T5asxlMOubhtH
                                                                                                                                                                                                                                MD5:3F4DF829755266903216959BAECA4255
                                                                                                                                                                                                                                SHA1:BE10044EFDC59FCD4C359AFE2A11A1AA153D25F9
                                                                                                                                                                                                                                SHA-256:CF4A675E309538C2160B777DF0800A219D234F2582A237CEBB120FCA3D444597
                                                                                                                                                                                                                                SHA-512:9B5C305204903DE36D41AE620600FA21572779460C56E9FEFBE888B3EB1DFD3AE05398FCCB283C58619FC40608D2EB5D83F3F86799B74D6211B10B584B3A3BD7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERA044.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):102662
                                                                                                                                                                                                                                Entropy (8bit):3.07876077276848
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:8Ke/5vF7Fih7n+sqSqVpEw/DxteqXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+e:s
                                                                                                                                                                                                                                MD5:9D1C4364EBC176E1707C8A3B9D23BA2D
                                                                                                                                                                                                                                SHA1:CC3D54987C3E2BC983BFA913EDB91978F26784B4
                                                                                                                                                                                                                                SHA-256:BB207A69CF0C789A9AC0EA584C2267EBCA5418E3E8C132F6650D85E12A366379
                                                                                                                                                                                                                                SHA-512:84F3B3EB09A4014E30D2E8665D76335251B97E70752F2DA56962FF8230618101DF808BB8FB96ADE61E7EB0DFD8AABAE5B10353C05821381E4D47F8597F5C3525
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0EC.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6974769004971013
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtjcIP7F4/dYuYEFWuHnYEZ0rtFi43eDSYw7SH33KaFxn8MTunGIDtnj:2ZDvtQ++JiRSXaaFx8MTuBDtj
                                                                                                                                                                                                                                MD5:813D0970E4E2CF7F803EE4C29D201096
                                                                                                                                                                                                                                SHA1:FB3B465F3250C9ADDA7D75115E94D8A0FFB33B13
                                                                                                                                                                                                                                SHA-256:988B0EE6D6F07CC635209E4C2B7377E757F0BC90CC019245065F875FA885C001
                                                                                                                                                                                                                                SHA-512:C1B283559722257A9F1D57BD4E53E5E95D3E50F64BF9059C88340D6C4BE90B7057CDDBB9034AD69E10886BA656B9092EF415142C3C00A46C07C250E9B4FC2029
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERA33.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96222
                                                                                                                                                                                                                                Entropy (8bit):3.0867467215979616
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:FI6rZI3xK6XvoejmQ3L79pZLGcA6ATXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+z:FI6rZI3xK6XvoejmQ3L79pZLGcA6ATXb
                                                                                                                                                                                                                                MD5:9F6BD44453057AC9107FB9AC1734BDFC
                                                                                                                                                                                                                                SHA1:8C6B7AFE8A817CE5F3A38BCD28E087B8EC8BFC65
                                                                                                                                                                                                                                SHA-256:02C30D9AF76209BCC98E406E247F9E77132EF06D0E5D6EF7C98157BA61096ACD
                                                                                                                                                                                                                                SHA-512:69470AE934D5BB46082CBAE0444203015CA12E4D82C790A4B658EE4B58009BD36C11DB6FDA784B7D27A1AABFE1943C798A8504484CA6274D849E84F3FD50B1A1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERA63.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6979691179867253
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtfAvr8Y9LYsBFiSkHSYEZyNtFis3eDFwLZeaXxQM2u2nIlAtH:2ZDvtf4Lj8XQaXxQM2u3KtH
                                                                                                                                                                                                                                MD5:E8ACC454C2A3B528A72A9C3822F7902F
                                                                                                                                                                                                                                SHA1:EB428F927F793FE3D2608E5E84F33448A4A60202
                                                                                                                                                                                                                                SHA-256:20A20A38D41423678EC8DF18BA40D143921FE5BAD574531AE2C85415F8886BAF
                                                                                                                                                                                                                                SHA-512:3E8D1723B61C7B84429CBDFABB6D2877DFC36FC9FF09D0B468EF107BD20A1E48B5C4D92A60B05441F54D9B7172A27080963FF0AB312E1F40B6972EA2917593C8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB2.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6979390235607155
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtlbWpc1Y8YKFJvHSYEZ3bztFit3jDTwiwoEaNxmMHuQIlItH:2ZDvt1bGbO9EaNxmMHunCtH
                                                                                                                                                                                                                                MD5:56279B1766BFE1622E7D2EBD24CEA017
                                                                                                                                                                                                                                SHA1:FE332CD48B9FB20E9C620006170AA485C28E2D34
                                                                                                                                                                                                                                SHA-256:CF09BCC1DCB83E95600F40D02087A1BE1E71FBB9D76B3296E7FC80A88434063B
                                                                                                                                                                                                                                SHA-512:CBA38E3670443AC22CE5358163843B0767996AC54DCC88ED60B63C634BD07F07BD8A24FC69C61759C6D4FE01916E8F892B8B4CBD5D739CC56CFB537CDDE1A9A7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERB01F.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99916
                                                                                                                                                                                                                                Entropy (8bit):3.0824092868765236
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:3azPMZWK9S5xPP0KybgebrQg+GRlBXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+xu:w
                                                                                                                                                                                                                                MD5:479EE15DB54AC5C50A3CF806E78F82D4
                                                                                                                                                                                                                                SHA1:0E9ACD25E5AD798880E20B211F5AAAC73A7F5076
                                                                                                                                                                                                                                SHA-256:A8623E9D1C88C6437C041BB1C367843F21A67AB04A27416B2306B08D74D256BE
                                                                                                                                                                                                                                SHA-512:43CBEA46A8B5DA1986F18737A59B8752A3967702521B4BFCBABA18FBF11ED05C86D7532F9102FE141995ED6726E210B611F1EA5915B984698A8283135FDAFDE3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0FB.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.697142192784567
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtevb2wBmYyYQFGpH7YEZz6ZCtFip3QDKwTxTXadxaM6ubIWta:2ZDvteCFLZqtadxaM6uUWta
                                                                                                                                                                                                                                MD5:BB2C703669F4BC9193B0A298ADA2CC24
                                                                                                                                                                                                                                SHA1:B0963081FA96C0BE3403CAF0F4069635BAC3545C
                                                                                                                                                                                                                                SHA-256:51BC0B09BAA44E84A599D992C6E272D7F731EA146EC3A602FDBA85B110874005
                                                                                                                                                                                                                                SHA-512:524C02709C6FABB8CDD3E71772F460FEDF553BE1F0EE748214A2AFC8162075FD7EB36D7A49126A5C9D218FCE73A079147E185FAE9ECABCE76197B553D6F77AA1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERD230.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):93650
                                                                                                                                                                                                                                Entropy (8bit):3.0896214024729924
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:jPZ7Sn3ANqklg0wfJwkbrZg/LcMvlxXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+o:jPZ7Sn3ANqklg0wfJwkbrZg/LcMvlxXw
                                                                                                                                                                                                                                MD5:1B838CB350EEA1B66A82FFAC4CB32564
                                                                                                                                                                                                                                SHA1:20503CC9B983DBB1AD58258CD9DB1DC9463C7173
                                                                                                                                                                                                                                SHA-256:56307D78B840A3E912A9950D2195A11AA17B93DA13B4C2ABBBD1F3B88E82DFA4
                                                                                                                                                                                                                                SHA-512:9DCDA8874AB77DA5CFE819B07237121225738ED52C2AB7D52688CFBAA1C36223BA21B4A11789CDA2EEF69C1AD23FD8E81C3FEFBB169D054E6618A9EE544339D4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERD35A.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6971972325994495
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtN1CR/gYTYJFYtpHHYEZ1YtFiK3pjDEwIzlXVakxrgMIucINtH:2ZDvtcYklXzPakxcMIubNtH
                                                                                                                                                                                                                                MD5:985566199F2B21058570A662BF78BB19
                                                                                                                                                                                                                                SHA1:761198768AB247A5DD54B06A7ADE0C4E80A258BF
                                                                                                                                                                                                                                SHA-256:5B2B6E96D5BB975DFDDF8FF8A0F629D5D1690349B1880602A03D0FD5DB17AF20
                                                                                                                                                                                                                                SHA-512:2F87FE08C54C3B98EFC95273A1A9414AC9AA9A26366922ED2EE8A6E67BA6CC3951DD90B85CCE2E2AF97B2595E87C0EA5C0DF271DF5857D57A16A6C850C614D88
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERD59D.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):93610
                                                                                                                                                                                                                                Entropy (8bit):3.0897914286655705
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:6DHpAr9ZW3QHbqgugC9u6wkbiZgNUcMveXxaq+x736+b+X+3+Z+2+3evg+DU+5+N:6DHpAr9ZW3QHbqgugC9u6wkbiZgNUcMB
                                                                                                                                                                                                                                MD5:55D064CD08F07351B7BC06BDFB1B845C
                                                                                                                                                                                                                                SHA1:980761AFC1A12954143D1AD7A0B557FDC3E58B44
                                                                                                                                                                                                                                SHA-256:1A5EE7E7A890939ED5545FF56174CC6033C49D0C09E87DDDC2EFF64B296632AA
                                                                                                                                                                                                                                SHA-512:30C835E2DFA2937A8E99F018E99DBFC6CA923EE3C0D59C9FCD264D810B114979258AFF58A54743FB474FF8024F6ADAC9635B05DC38856B169AEA8F0412A2E419
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6F6.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6972442109834884
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtk2nAwHAYgYKFYLpHZYEZQVtFid3eDDwT2Skea4xOMe1uUIItH:2ZDvtFgXgSSza4xOMKuDItH
                                                                                                                                                                                                                                MD5:527FAAD2ED2687339CBEA2E508C85B98
                                                                                                                                                                                                                                SHA1:D1D63A9D6E141EDC8200ADF3B273F23600565A8C
                                                                                                                                                                                                                                SHA-256:6D995D0B1B22F4D70175B10F8B6299FD29D7C1D09E17A4487E890D8B6A531D5F
                                                                                                                                                                                                                                SHA-512:AE3AE841BA814205B83DA2B8F810DC8DEE7BB2B231FB0C3241D0449F6E2EDEB9D51FD18F7AC2415E6DFFD7263CCE24B5733738745C28C828FA2201E3F3FC8170
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERDABF.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94018
                                                                                                                                                                                                                                Entropy (8bit):3.0888335182480566
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:HoEgZO3QHSOAAygCSYFyB3biZgNUcMvMXxaq+x736+b+X+3+Z+2+3evg+DU+5+3+:HoEgZO3QHSOAAygCSYFyB3biZgNUcMv8
                                                                                                                                                                                                                                MD5:7F22758175DE9AE955097F95D615618C
                                                                                                                                                                                                                                SHA1:FA30B9420DE71D9C01359616637ACD1A6547586A
                                                                                                                                                                                                                                SHA-256:DB629312B3F15498DA03BBF6ABBDC3C66B9A56061BDE9CF18C7D201AF2C3E6EF
                                                                                                                                                                                                                                SHA-512:3033DB2E7DC0CFBC9431C09F6E5848C643E9914D63F575F5E0E031515BA41D7445D8CDBC9BE53CED595A4F05D67E17AE833CDC5E6172FAEC692B797F0FFF8B30
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD31.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6979195593967007
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtTCKdslmYUYiFU2pHZYEZQatFi03IDRwc9DHz8naw2xjhMduJI8tH:2ZDvtTnTYPRSa7xlMdu28tH
                                                                                                                                                                                                                                MD5:BCF733E293E48FC3719ABA0CB277B760
                                                                                                                                                                                                                                SHA1:09499D52B0B8893A2DA07312027B120563C3D077
                                                                                                                                                                                                                                SHA-256:1F33957592A57EE32B99E6CAE8D6BCFC85BA933F4F04FD3AB5D67691354B65C5
                                                                                                                                                                                                                                SHA-512:2B58638FFEE19402BFA6952C189B4EE4615C1B9F98DDA31871ECC7A14B435DF0AB181B7165549661FF410CEA0AB822A67FCC84C83888FA0BC5E4E8C7642A9D81
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFF.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95132
                                                                                                                                                                                                                                Entropy (8bit):3.087708554705811
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:Mp6IjfRmG3eoVvvokkE6vL79pZLCcA6cgXxaq+x736+b+X+3+Z+2+3evg+DU+5+L:Mp6IjfRmG3eoVvvokkE6vL79pZLCcA6A
                                                                                                                                                                                                                                MD5:A6B1B3FDC629F33EDC8E6B0F42DBA674
                                                                                                                                                                                                                                SHA1:76CE1D44941C55FC0AEBD4F53B1BEB272837439E
                                                                                                                                                                                                                                SHA-256:263C84230A54C4B2E30D7BBEF150A4EC4D9A88FEE0C65E6C8D9D21BC1587F3FE
                                                                                                                                                                                                                                SHA-512:D708122CBFE6322435B62B44863E97D37C11BC9E852064B61E8159DA5CCB14C63761DA29E22D36E9BE0DD5E9E947AD05C62AB3D6D853850934BAA5B63741D960
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERE06F.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):93660
                                                                                                                                                                                                                                Entropy (8bit):3.0890182627967095
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:r4hzl9qMn3wbdYnA/gCiDtB/biZgqUcM2djXxaq+x736+b+X+3+Z+2+3evg+DU+q:r4hzl9qMn3wbdYnA/gCiDtB/biZgqUco
                                                                                                                                                                                                                                MD5:81CA88EF9C1C4828E3FE78D387FEA218
                                                                                                                                                                                                                                SHA1:86C66CAE7AEA86ED559E56FF46C75F888AEB6F44
                                                                                                                                                                                                                                SHA-256:C04A225B473853D4F50E3E649EDEC9A02FD0B716A592C7D65A78765C368698F2
                                                                                                                                                                                                                                SHA-512:8DBC7C3AF36F8FC35A570A82D979EBA3DC3C4ED78EBC6CE7FA54DBD80F8ACCA2B41B0BB4E94A47DF09C0D30B1BAFC5461BE0129AA8C9C2083F0F5BA05A1EF57E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERE12B.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6978415715132846
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtrDIKm5Y5YGTFspHZYEZ+jtFim3qDdwzuOVSa0xyM1uzIutH:2ZDvt0e3vLuHa0xyM1u8utH
                                                                                                                                                                                                                                MD5:A6939773C18B1F4BBDAA26506E0C95D2
                                                                                                                                                                                                                                SHA1:6DD12D1391B578577DAA80F1682B2A11050CC8AC
                                                                                                                                                                                                                                SHA-256:278C53A001C8BAACFFBB5C7C8014F34AB31011BC9AA87F82B018BB75082D0F75
                                                                                                                                                                                                                                SHA-512:A4DAA4546A5ADCFEBE7E51AC1C102DAD0B3C195B724C5E90B3C92CE0BFE26A15707819A217DFCD9D9AD25F89A822EB4FAC921E151D1C6F66C9FB3B6BE658D087
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4D6.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95018
                                                                                                                                                                                                                                Entropy (8bit):3.0874107399426713
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:lXx4UVS3wVdYOAxgCikrL/biZgCocM2UyXxaq+x736+b+X+3+Z+2+3evg+DU+5+W:lXx4UVS3wVdYOAxgCikrL/biZgCocM2z
                                                                                                                                                                                                                                MD5:B47346FDEB7A86971139B1FE3C663ABB
                                                                                                                                                                                                                                SHA1:C1F8FE9453D12FD15A82E3E334D59C35BDDCE30B
                                                                                                                                                                                                                                SHA-256:C5E1F18B23B6DED3F26D490D63FF7630EB16795EA1BB9607216DB3BD23CA7471
                                                                                                                                                                                                                                SHA-512:3A57F0E7B85E15A90B23E3F93820EF5CF2DB08A0AE45DDEE8F71320FDA49CC24B3EDF9857A0BBB7AB9C97CC90CEDEE49655FF654136B1568AFE7B3F65B6F0387
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5FF.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6982404145314285
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtEbqgGYHYhFnupHZYEZiptFi737DQwdBHbaFxbMGupCIXtH:2ZDvtJAiUNaFxbMGu7XtH
                                                                                                                                                                                                                                MD5:01E393AC2FC2EE578B2D5FAF1844B1A9
                                                                                                                                                                                                                                SHA1:F7163124C392C8A22DB9B860C963E7F46B9880F2
                                                                                                                                                                                                                                SHA-256:50CEB0514AD707B77862E1531AB1A47C558E4800BFC2CCB547B7E9A51A94BC69
                                                                                                                                                                                                                                SHA-512:738CB68DF305B33DA7D450AE2DA37717668E2FEBDF6DAE2968D985EFBB5C1D99A74F3D62038F2ED3F64BCE8B4387FE923C57F3A62BCB23EE40FC86E533D62CE8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9AA.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95422
                                                                                                                                                                                                                                Entropy (8bit):3.088175171942045
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:DSIXG39ttfEAwg6i07/biZgCocM2sVXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+Q:DSIXG39ttfEAwg6i07/biZgCocM2sVX4
                                                                                                                                                                                                                                MD5:2B82289382F2CA5247B696AF8CC5172C
                                                                                                                                                                                                                                SHA1:AC027BBBAEF0F9B3658813F98887B856D3CDB1D5
                                                                                                                                                                                                                                SHA-256:65D6DDF7F1AB1C7506ED20846363F0F0E8AB21C9820015A6FAD231BFA4E096E6
                                                                                                                                                                                                                                SHA-512:4984D203EBCFF41EC2AF704C8D36FD8495DF23534C8D54C4CC19709357B66CE683D3EC2D9D1F585A90A301CA31569D2C64E8B466A1AC42142A3DA38FCC9B588E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAA5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6985495261755674
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtFq3EGTbYlYrFiCH2YEZZYntFiF3CDowM5Lj52aDcxaMGuVIktH:2ZDvtFwiUyp52a4xaMGuqktH
                                                                                                                                                                                                                                MD5:656283BCD24336432C2C26161176C557
                                                                                                                                                                                                                                SHA1:11F955D2FB0BFB9FF57BF8E0081F0E6C2EE6DBBD
                                                                                                                                                                                                                                SHA-256:84A158F04D94384641C52D8BC9DB23F06B79F6F062C746880EB52F2A092A0E8F
                                                                                                                                                                                                                                SHA-512:41D674F67E51261F324BADBA8DB2C479CF001C60562D1AB63FB2C3819BE95174B22EE63EFF93124E6AB168811C694ED84902CBB3DF653F26779CED2CA74168CB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAB6.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95036
                                                                                                                                                                                                                                Entropy (8bit):3.088661965071641
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:0Oa6i3+3XN3ADg6iG7/biZgCocM2XkXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+g:0Oa6i3+3XN3ADg6iG7/biZgCocM2XkXo
                                                                                                                                                                                                                                MD5:767AF7561D1A6D71420CA33BF84EAEA5
                                                                                                                                                                                                                                SHA1:E32C3841AFF55722199F1EB1A69B9E47BDD7C64C
                                                                                                                                                                                                                                SHA-256:54F7DE7F47370A9E683956B46642072BAC7B5C977695B68673A06C7F989F0183
                                                                                                                                                                                                                                SHA-512:0BCFB6600CD05FB3566BCEF533F8DBCD08ACF790DBCD1CC1B3F7E5065D5BD4E7E900ED93AC05E9BC518B028528189349108661A06D7467803D74148F4BEC233F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB53.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.697682409315487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtlP2nEjYYjY0kFKCH2YEZh7CtFi73TD6wnFJ/jqajxEMoukIXtH:2ZDvtlDYkB1FlqajxEMouTXtH
                                                                                                                                                                                                                                MD5:E6CF9C29BD8C8FCA6813EA2B437B85FC
                                                                                                                                                                                                                                SHA1:996BA8D031D559CE978ACB4F6B03B12ADD88F974
                                                                                                                                                                                                                                SHA-256:0D406CBF0BED65F87BE5ACD361752F89CD6513A9688FE1AE822E7A4B37C2F6D4
                                                                                                                                                                                                                                SHA-512:B028A1A714D89233CF4C7A8E705D5ECEAB9D5300087D4A03027061503DA3838022F2C6BAE980FA6F49BD615678C3E43E829C09B1E176B90B1BC9F3F4E562B093
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE23.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94246
                                                                                                                                                                                                                                Entropy (8bit):3.0897529627328133
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:pQvd03bZA0Aqg6uX1/biZgCblcM2GjXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+m:pQvd03bZA0Aqg6uX1/biZgCblcM2GjX+
                                                                                                                                                                                                                                MD5:8F662C6D1B38DB2DE07FB0FA4F751C0A
                                                                                                                                                                                                                                SHA1:6F377A8231737993130D328F65C4C6B636AB5916
                                                                                                                                                                                                                                SHA-256:823E882B2317DAAE09340A0DDA30ED36C17AD408C4A2034DB840DF716C42F19F
                                                                                                                                                                                                                                SHA-512:08060642D7AB30C89ADB5D7074A2B91E1B9B6C22C7B897B0AF8524385F5CDE86F54FC9345B1014719750A89DB878C66ABCE39544A1D15984F156EE56781A360A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE81.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6988361856239487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtybwdtT6YBY7FR6CHpYEZ12vtFiO3uDYwxba+OC2azxJMGuAIwtH:2ZDvtd62Wv2ubqzazxJMGuXwtH
                                                                                                                                                                                                                                MD5:90A244D3B80F3665AF6E8FD5FFF57597
                                                                                                                                                                                                                                SHA1:9CC37B254F731C5E84076BDA77C6DD3AAFFF461C
                                                                                                                                                                                                                                SHA-256:A2FD60B55A10FF3075584329E3E7E10C75724251168B4175FC19A9A717911183
                                                                                                                                                                                                                                SHA-512:8E74FFA640D2443C4A6341E393F66CB57B8C4C7FDA422120F5FB32BC8F28FC7D69C7DD6D5DAD4F478E53828573340616DCBF033F28C730AD675860A4CC654F64
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF29.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6985813374072554
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtXH2atdYAYQFvlXoHIYEZsStFi83iD8w/bMRanx4MvuLIlntH:2ZDvtT3FsVbAanx4MvuE9tH
                                                                                                                                                                                                                                MD5:03C3CF64D9F7F2D392C0AF227D4E0A62
                                                                                                                                                                                                                                SHA1:4D82910FA7B06703E0B11329D54E2E7C6A6FAAF9
                                                                                                                                                                                                                                SHA-256:600D551059D7F6C2AC3B8975FE90B8BB37C1CDF927AFB06B511681F3D6A335E6
                                                                                                                                                                                                                                SHA-512:8954CBA366DA28939538CA367D9E742C46819218BFADABCBBA4D4327402B8940D1B81B839ED299C72A8CE3639A5EBE00C5C65B669C66CA79F1F63EB20E835468
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2D8.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):94690
                                                                                                                                                                                                                                Entropy (8bit):3.0892855371984353
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:ZvJt3WQ53Aqoug5/biZgCblcM2IvXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+P:ZvJt3WQ53Aqoug5/biZgCblcM2IvXxaj
                                                                                                                                                                                                                                MD5:97D8552CFC21233F12224D9CAD232721
                                                                                                                                                                                                                                SHA1:FAFAA6012C5FD5AFBD2B4BDD9FE112D510367245
                                                                                                                                                                                                                                SHA-256:4A9DDF4195990BA7D9904C650A182A70036857F829CF9365D1D23A5408932F26
                                                                                                                                                                                                                                SHA-512:FD659E4633962AFB32832A28CFBEC47235709723DB0E2811EFCE41728D147D08EDB8411E32E14BE8EFC470E243A5E4F19815CC9ABC14C0DB57E099E8C3BAEB93
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2F8.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95016
                                                                                                                                                                                                                                Entropy (8bit):3.0888408364219626
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:mCft3WuSjAqouM5/biZgCblcM2qvXxaq+x736+b+X+3+Z+2+3evg+DU+5+3L+x+D:mCft3WuSjAqouM5/biZgCblcM2qvXxaP
                                                                                                                                                                                                                                MD5:62B9476AE0E848BC4D511D596CE9FF91
                                                                                                                                                                                                                                SHA1:D42A51F369FA1A790BB1C0E62DBA8406210AF7AF
                                                                                                                                                                                                                                SHA-256:F2A6BF1047A209FB8E473A6B0486373BBEECD7780C9D670E217EC2ED6D83E1F9
                                                                                                                                                                                                                                SHA-512:EF395F6155EDD4991BEE6FFA3DE4C9A9125638229211201421AC21699F5BC49B7A13A3613FD348D937E721FE9BB6E27B81D4593EA931A71224952C5739490941
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF386.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6982525028542237
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtgUpBBMY5YHF5HjYEZVItFiA3aDNwS4daYxLzM9uhIRtH:2ZDvtgZ+W5waYxHM9ueRtH
                                                                                                                                                                                                                                MD5:916D99C8FCDBA98435C4C66B40D01430
                                                                                                                                                                                                                                SHA1:424471E0AF3979CBEDDF4AAE652CCBD61BAF2179
                                                                                                                                                                                                                                SHA-256:DAA1A2A7866738ECF9A4222361FE6034082D489C03ED88F39802D81564BFB7EB
                                                                                                                                                                                                                                SHA-512:2FA3068999924C3F8CEE2271CEAD7EF818F97DBD1749642AED525DDABEAB5BE9D969719215945D91F8A2DECCD6BA68EB1E23A269E477F6B18C16262C69233D60
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3B5.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.6983655077299926
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtgZp+49XaYY2EYGFu/HjYEZkMtFi33bDNwbyNaVxdaM7uKIstH:2ZDvtgUDq2euaVxYM7u9stH
                                                                                                                                                                                                                                MD5:7C9EC3DD6953E1FADD22C0AD5C589F86
                                                                                                                                                                                                                                SHA1:885A8D4EA3E181125F4329AAA36149885823F570
                                                                                                                                                                                                                                SHA-256:7859E69899D53650CFE831DBEFBED0B5EC831D771AA5A6125AA018BE184FF777
                                                                                                                                                                                                                                SHA-512:0B59F119B2F11B5C17DB4C4F813733174DF0693F11171BCA26832804E2493099B9B19EC3EED0FF5A4639A78CA59C6454BD7807A636D87265254B96A37090DA9A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE94.tmp.csv

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):95418
                                                                                                                                                                                                                                Entropy (8bit):3.088591286653845
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:MG76wO73OWFZAqoJXIZ/79pZ0ocA6teXxaq+x736+b+X+3+Z+2+3evg+DU+5+3Lq:MG76wO73OWFZAqoJXIZ/79pZ0ocA6tet
                                                                                                                                                                                                                                MD5:04BCC60D62BAF570B1FA52EE180D5249
                                                                                                                                                                                                                                SHA1:63F4A284D1837577B3917F1C75368045380A5335
                                                                                                                                                                                                                                SHA-256:4194806ED6E0BF8D3881E0D499313DA58368C46412EB6D6C271E206E0D0E6FCE
                                                                                                                                                                                                                                SHA-512:B2EC08363DEECF4A36C8DB7F0678A39A946A8613444D767677F7630D5325973688987A035579551DBC9904392ED10095622DE12699665772E0E5539CEA526EF8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF7F.tmp.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13340
                                                                                                                                                                                                                                Entropy (8bit):2.698046716817062
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:TiZYWvtiZYyTYPYmFhHiYEZLetFiX3GDqwTynQaBxIMhuhI+tH:2ZDvtsIOqTaBxIMhue+tH
                                                                                                                                                                                                                                MD5:B6CB9B1A09E6D0D74F0F9D292AFC127B
                                                                                                                                                                                                                                SHA1:DEBAAAF520325D72C29526831A18F31F119A8AAC
                                                                                                                                                                                                                                SHA-256:A4A3CDAADA16067AAAE00B26C30CAC47168B833DFDDBCB8CB19F625EF6C443DE
                                                                                                                                                                                                                                SHA-512:2FF495738ABF135A83058B17C7B2713EDF9E3ADFB1364DD5D7A362830DC659155A8421BF9E297D530F0BD5BD6BB50E80D442622A6694A31771F1340D09F04B2F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                C:\ProgramData\PALRGUCVEH.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.696508269038202
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
                                                                                                                                                                                                                                MD5:0E9E92228B27AD7E7B4449467A529B0C
                                                                                                                                                                                                                                SHA1:209F92CDFC879EE2B98DEF315CCE166AFEC00331
                                                                                                                                                                                                                                SHA-256:284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
                                                                                                                                                                                                                                SHA-512:CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

                                                                                                                                                                                                                                C:\ProgramData\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.696508269038202
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
                                                                                                                                                                                                                                MD5:0E9E92228B27AD7E7B4449467A529B0C
                                                                                                                                                                                                                                SHA1:209F92CDFC879EE2B98DEF315CCE166AFEC00331
                                                                                                                                                                                                                                SHA-256:284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
                                                                                                                                                                                                                                SHA-512:CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

                                                                                                                                                                                                                                C:\ProgramData\SNIPGPPREP.docx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.701796197804446
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
                                                                                                                                                                                                                                MD5:C8350CE91F4E8E8B04269B5F3C6148DA
                                                                                                                                                                                                                                SHA1:22D523A327EBAF8616488087E2DCE9DBD857F0CC
                                                                                                                                                                                                                                SHA-256:1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
                                                                                                                                                                                                                                SHA-512:C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

                                                                                                                                                                                                                                C:\ProgramData\ZGGKNSUKOP.xlsx

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1026
                                                                                                                                                                                                                                Entropy (8bit):4.6959554225029665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
                                                                                                                                                                                                                                MD5:DCABA2748DFEAEF0BFBC56FD9F79315C
                                                                                                                                                                                                                                SHA1:B87FBA690A774893B22B9F611DFDCB5CDC520269
                                                                                                                                                                                                                                SHA-256:86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
                                                                                                                                                                                                                                SHA-512:65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

                                                                                                                                                                                                                                C:\ProgramData\freebl3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):685392
                                                                                                                                                                                                                                Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):608080
                                                                                                                                                                                                                                Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\msvcp140.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):450024
                                                                                                                                                                                                                                Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11214848
                                                                                                                                                                                                                                Entropy (8bit):7.97772484802616
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
                                                                                                                                                                                                                                MD5:B091C4848287BE6601D720997394D453
                                                                                                                                                                                                                                SHA1:9180E34175E1F4644D5FA63227D665B2BE15C75B
                                                                                                                                                                                                                                SHA-256:D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
                                                                                                                                                                                                                                SHA-512:A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2046288
                                                                                                                                                                                                                                Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\softokn3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):257872
                                                                                                                                                                                                                                Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\vcruntime140.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):80880
                                                                                                                                                                                                                                Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:56 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2104
                                                                                                                                                                                                                                Entropy (8bit):3.449971404284456
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8SPl2dfTXddRYrnvPdAKRkdAGdAKRFdAKRE:8SPlOG
                                                                                                                                                                                                                                MD5:56CF77F8FE557CF143951C508CB8C8F2
                                                                                                                                                                                                                                SHA1:E550FEAE54A5B994F98A9315815BC1AB761F5CAA
                                                                                                                                                                                                                                SHA-256:16DE7D00ECC7C2F98CFF94C971C54D3E7265745F2F0354C2EDAD0CD961C49356
                                                                                                                                                                                                                                SHA-512:C74DB68174E9F3183E42516CA73E40D165D234AAA67E5FE24A0A666FC886A2B18AD6C1BB10C281503A64C17774C54DBBE02907EB273E6E8D601CA00A9D89A28E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:L..................F.@.. ......,....E..n.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\AdobeUpdaterV1_5fc4ccc1a69cead8abaf9c75121d8fec\AdobeUpdaterV1.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 33%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):3948834
                                                                                                                                                                                                                                Entropy (8bit):6.382123082161787
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:3egaBHXr8oHOIlk8TlTwGRWH9M5odueM6V:FaBHRz2djueZ
                                                                                                                                                                                                                                MD5:00B640E64C35C1E3F7AD1CB9A979BF2E
                                                                                                                                                                                                                                SHA1:FDAC8B1FCA30576355B38345E045601EC2BA41E2
                                                                                                                                                                                                                                SHA-256:A2CE846A84F5BD3D1CB8C0449915508DFCA1F67F6CC12A435F17A411E5D48012
                                                                                                                                                                                                                                SHA-512:B2C94D43A899490864F17246CB8254EF44EDB6AE76A23EB3AC369B5391E7F42BE6D6BC816E9E0A1487E841AF2C5E801FB9070E42A04810D01AC1A81DEF715C1C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 49%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.....................`.......u............@...........................<.............................................\........p...............................................................................................................text............................... ..`.rdata...6.......@..................@..@.data....T.......0..................@....rsrc........p.......@..............@..@.rview4..P*..0.."A*.................a.%.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-0MI7C.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):392048
                                                                                                                                                                                                                                Entropy (8bit):6.542831007177094
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
                                                                                                                                                                                                                                MD5:EE856A00410ECED8CC609936D01F954E
                                                                                                                                                                                                                                SHA1:705D378626AEC86FECFDF04C86244006BC3AF431
                                                                                                                                                                                                                                SHA-256:B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
                                                                                                                                                                                                                                SHA-512:666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4*.$QN.%4*.$.N.%4*.$IN.%4*.$YN.%.*.$HN.%.*.$GN.%.*.$KN.%.*.$XN.%[N.%.O.%.*.$iN.%.*.$ZN.%.*e%ZN.%.*.$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-3KPDG.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1471856
                                                                                                                                                                                                                                Entropy (8bit):6.8308189184145665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
                                                                                                                                                                                                                                MD5:A236287C42F921D109475D47E9DCAC2B
                                                                                                                                                                                                                                SHA1:6D7C177A0AC3076383669BCE46608EB4B6B787EC
                                                                                                                                                                                                                                SHA-256:63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
                                                                                                                                                                                                                                SHA-512:C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-3TV13.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):719720
                                                                                                                                                                                                                                Entropy (8bit):6.620042925263483
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
                                                                                                                                                                                                                                MD5:20B6B06BBD211A8ACFE51193653E4167
                                                                                                                                                                                                                                SHA1:817D442B46DD6F35FD9641E0C7262C934ED76848
                                                                                                                                                                                                                                SHA-256:7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
                                                                                                                                                                                                                                SHA-512:0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-46DUV.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3948834
                                                                                                                                                                                                                                Entropy (8bit):6.3821227735150625
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:KegaBHXr8oHOIlk8TlTwGRWH9M5odueM6V:waBHRz2djueZ
                                                                                                                                                                                                                                MD5:13ABBACE3B03E6A4A0AA014E27078CA9
                                                                                                                                                                                                                                SHA1:DD788E472679CBD8E7C3DE1AA5FBB53B0CD36A96
                                                                                                                                                                                                                                SHA-256:F4569C84B5D48F50A3829B0306DD2C2E85240C63020EA93A2DD3A8E4A22D2CD8
                                                                                                                                                                                                                                SHA-512:36BBCFFC35D82055BA04D022068C44764CCC909E015A0F05DAEBD109402BAE6FEDBF468127A3237BBFFFFEA7FD00C8B50FA43264CDC067AFE1E5FC72E6325A08
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.....................`.......u............@...........................<.............................................\........p...............................................................................................................text............................... ..`.rdata...6.......@..................@..@.data....T.......0..................@....rsrc........p.......@..............@..@.rview4..P*..0.."A*.................a.%.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-FD6NC.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):674074
                                                                                                                                                                                                                                Entropy (8bit):6.478491287094956
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:feuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYZajlxpd:GuHcrgVxrPy37WzH0A6uwkNK4Klxpd
                                                                                                                                                                                                                                MD5:E1A335EA01D3A3ADA805DD2D2ACBCF99
                                                                                                                                                                                                                                SHA1:5F3B3C7529B9076A1CF38885CE9E99BD4E47C376
                                                                                                                                                                                                                                SHA-256:D7D7BC2ACBA4160C1109F26B76718EC07BF759E03DB41C4BAA5B414D78F5659A
                                                                                                                                                                                                                                SHA-512:B226E87D2AF3E3D1C47BBD295EE294A6285F652726E9EE983852D4A0618EBA44297F85CEC2441593E379CB738BD2FFE4BF5C0DA65BAC1D43FC503B30C25E69FA
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-O7LCO.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):463552
                                                                                                                                                                                                                                Entropy (8bit):5.599726933414548
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:1v1LP70TRPsLj3npXMEme9VE4jiEB9EpVYz:nPHp8E59VE4OEBwez
                                                                                                                                                                                                                                MD5:16CF86848A0BC06CFD7263709C532C93
                                                                                                                                                                                                                                SHA1:1A12E44836A555991264F98AD9F85F6C3D679982
                                                                                                                                                                                                                                SHA-256:26CD906968EE228FA898B8FE1E70200DBFED5FA22A8BED9794C85B288DED82E4
                                                                                                                                                                                                                                SHA-512:B0E691B3CB6A3AF417DFBE91F0422504C2429F055B84A8AD46F4406362877D6DCDD1F6BDB689C67744C3434700102CF6CC6D3FC9AFDD9436643A1945187BCBC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:........=*..10.9.194.10.....................................................X....c...7......p...........a........a........aR.......ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-OEOPV.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):163520
                                                                                                                                                                                                                                Entropy (8bit):4.871982862640311
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:gq3dmSi74uUaTDJT3iAzoD41Ozl963dptyS//S29BgyL7OoxS4M7egm4DGNDa4Jo:gvTFT38D41Ox96tmW7Dg7KuZ4I3V
                                                                                                                                                                                                                                MD5:04D8E967D61E02A74AADE39E8C1D9A2E
                                                                                                                                                                                                                                SHA1:D2A7A4401435FB62AD1359BC2C3ABA6C61D61DBA
                                                                                                                                                                                                                                SHA-256:1DDA0C7790693C4E36F5B978F548B6BB125B6C03FACEA2DFC1A92A0F54A93BF0
                                                                                                                                                                                                                                SHA-512:A7B21058A8CB260FA953D448878982D4FEBFEEFC08FD036C30523FDD55BF5F6E24DB0375ECE9C3516EB5BE4F40B3895785B089DA5B526CD970338AFFA3ADF85D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:........z.x.10.9.194.10......................................................;...............;..a........a........a........ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\is-QRQQR.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\libeay32.dll (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1471856
                                                                                                                                                                                                                                Entropy (8bit):6.8308189184145665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
                                                                                                                                                                                                                                MD5:A236287C42F921D109475D47E9DCAC2B
                                                                                                                                                                                                                                SHA1:6D7C177A0AC3076383669BCE46608EB4B6B787EC
                                                                                                                                                                                                                                SHA-256:63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
                                                                                                                                                                                                                                SHA-512:C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\libssl-1_1.dll (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):719720
                                                                                                                                                                                                                                Entropy (8bit):6.620042925263483
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
                                                                                                                                                                                                                                MD5:20B6B06BBD211A8ACFE51193653E4167
                                                                                                                                                                                                                                SHA1:817D442B46DD6F35FD9641E0C7262C934ED76848
                                                                                                                                                                                                                                SHA-256:7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
                                                                                                                                                                                                                                SHA-512:0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\snapshot_blob.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):163520
                                                                                                                                                                                                                                Entropy (8bit):4.871982862640311
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:gq3dmSi74uUaTDJT3iAzoD41Ozl963dptyS//S29BgyL7OoxS4M7egm4DGNDa4Jo:gvTFT38D41Ox96tmW7Dg7KuZ4I3V
                                                                                                                                                                                                                                MD5:04D8E967D61E02A74AADE39E8C1D9A2E
                                                                                                                                                                                                                                SHA1:D2A7A4401435FB62AD1359BC2C3ABA6C61D61DBA
                                                                                                                                                                                                                                SHA-256:1DDA0C7790693C4E36F5B978F548B6BB125B6C03FACEA2DFC1A92A0F54A93BF0
                                                                                                                                                                                                                                SHA-512:A7B21058A8CB260FA953D448878982D4FEBFEEFC08FD036C30523FDD55BF5F6E24DB0375ECE9C3516EB5BE4F40B3895785B089DA5B526CD970338AFFA3ADF85D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:........z.x.10.9.194.10......................................................;...............;..a........a........a........ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\ssleay32.dll (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):392048
                                                                                                                                                                                                                                Entropy (8bit):6.542831007177094
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
                                                                                                                                                                                                                                MD5:EE856A00410ECED8CC609936D01F954E
                                                                                                                                                                                                                                SHA1:705D378626AEC86FECFDF04C86244006BC3AF431
                                                                                                                                                                                                                                SHA-256:B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
                                                                                                                                                                                                                                SHA-512:666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4*.$QN.%4*.$.N.%4*.$IN.%4*.$YN.%.*.$HN.%.*.$GN.%.*.$KN.%.*.$XN.%[N.%.O.%.*.$iN.%.*.$ZN.%.*e%ZN.%.*.$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\unins000.dat

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:InnoSetup Log CD-DVD-Runner, version 0x2a, 3904 bytes, 302494\user, "C:\Users\user\AppData\Local\CD-DVD-Runner"
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3904
                                                                                                                                                                                                                                Entropy (8bit):4.434906996903586
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:oo5XfQ0HyM5LBv8SrkD8C6p1LGzE05dvV9m+4bLVO347150yt37t9y0V0270Bb0q:xv19p8IkD8Jp1qguV9m+eOIhVtx9ZM1
                                                                                                                                                                                                                                MD5:D5BDE3048E84DB420BB45EB18F6DC41B
                                                                                                                                                                                                                                SHA1:3D744D51F8EEF906FC17504516272EB1D5B6EE48
                                                                                                                                                                                                                                SHA-256:C73AECC2FAB3AEC44BECA6E194AA73ED42741E280DAA3B3FCE5ACE8F625E2FB5
                                                                                                                                                                                                                                SHA-512:454B8CB984B76B02D5CB804FB14EBBC3F4BD7001CF3EA0D83417EA36D3F1B821F621654FA7605CDB6B98B57747186F86F500AFCECB082649B5CBCDF143572991
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:Inno Setup Uninstall Log (b)....................................CD-DVD-Runner...................................................................................................................CD-DVD-Runner...................................................................................................................*.......@...%................................................................................................................1..t.........`I......L....302494.user+C:\Users\user\AppData\Local\CD-DVD-Runner...........(...... .....[......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..'...dll:kernel32.dll.CreateFileA.............#...dll:kernel32.dll.WriteFile...........!...dll:kernel32.dll.CloseHandle.......!...dll:kernel32.dll.ExitProcess.......$...dll:User32.dll.Get

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\unins000.exe (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):674074
                                                                                                                                                                                                                                Entropy (8bit):6.478491287094956
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:feuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYZajlxpd:GuHcrgVxrPy37WzH0A6uwkNK4Klxpd
                                                                                                                                                                                                                                MD5:E1A335EA01D3A3ADA805DD2D2ACBCF99
                                                                                                                                                                                                                                SHA1:5F3B3C7529B9076A1CF38885CE9E99BD4E47C376
                                                                                                                                                                                                                                SHA-256:D7D7BC2ACBA4160C1109F26B76718EC07BF759E03DB41C4BAA5B414D78F5659A
                                                                                                                                                                                                                                SHA-512:B226E87D2AF3E3D1C47BBD295EE294A6285F652726E9EE983852D4A0618EBA44297F85CEC2441593E379CB738BD2FFE4BF5C0DA65BAC1D43FC503B30C25E69FA
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\v8_context_snapshot.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):463552
                                                                                                                                                                                                                                Entropy (8bit):5.599726933414548
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:1v1LP70TRPsLj3npXMEme9VE4jiEB9EpVYz:nPHp8E59VE4OEBwez
                                                                                                                                                                                                                                MD5:16CF86848A0BC06CFD7263709C532C93
                                                                                                                                                                                                                                SHA1:1A12E44836A555991264F98AD9F85F6C3D679982
                                                                                                                                                                                                                                SHA-256:26CD906968EE228FA898B8FE1E70200DBFED5FA22A8BED9794C85B288DED82E4
                                                                                                                                                                                                                                SHA-512:B0E691B3CB6A3AF417DFBE91F0422504C2429F055B84A8AD46F4406362877D6DCDD1F6BDB689C67744C3434700102CF6CC6D3FC9AFDD9436643A1945187BCBC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:........=*..10.9.194.10.....................................................X....c...7......p...........a........a........aR.......ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\CD-DVD-Runner\vk_swiftshader_icd.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\128.png

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):29306
                                                                                                                                                                                                                                Entropy (8bit):7.92147583488826
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:xcjd3JISqF22OkACKSchdtm38rpsnNbd/bc7hS8mbE33wC06bA:mjISqF22Od6AtM8rpsNbd/WmSweM
                                                                                                                                                                                                                                MD5:F47A2FC416A8E5B5A89DF402C45F1C35
                                                                                                                                                                                                                                SHA1:7E57689F339B017C964A7CCFC44F823F664452FA
                                                                                                                                                                                                                                SHA-256:718B06ABAD15580EF39B01D703E7A8CF7EF00379FCABD16F77803BA14F0628DF
                                                                                                                                                                                                                                SHA-512:28965BB9E775CF74E879829F49EE48EBBAF3CBEF683B2A2AE25B23FB680DE3A94FCAB1CAB1AFC9D4962EA7F5F09D967A11B9AA0DD901DC4CFC2DF3EF04E067DA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:RIFFrr..WEBPVP8X.... .........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6VP8L.p../.....u!...........{.?..9g$..'..N...-n..Ul...qYX...8--..Qji.$.g&3g......=...m[..6..>..Q.........9..N.............o.......,.,.T*..}..@.......~.....qRQ.e.m.m.o...V..e..RI.K...>....$I.t.8..==|._}......EZ$ .......@i..!..)....@.l...ZF......a.$H.......P`[.d...aK.......Jg.l......`.:KA.0FF.....!..8U.;0.A...lK..:K.LE.,........K.d..J..KJ;,.... ..S.... ....H....H......R&. .X.Q.$.Cr")........K....*. .p....L...%..rd.Rd[..)....R...pZ...%.\.)!......@)...................0.......r.#.FB)..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadata\verified_contents.json

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1940
                                                                                                                                                                                                                                Entropy (8bit):5.966986363124249
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:p/hWI1+UaQPIJGXlvrouAdRakuZRZb+kFSRiRz:RN+UaQSG1jouQRatb+mYc
                                                                                                                                                                                                                                MD5:ADA17322FF1C9DBF585C9E924CB82874
                                                                                                                                                                                                                                SHA1:AFD6293B0DB4883557888A8A85DDEB188670F9F0
                                                                                                                                                                                                                                SHA-256:D498AB2F781B870559F4753D25844C6D518EED4A7FAB5A2699497CBCE652CB6E
                                                                                                                                                                                                                                SHA-512:16DEF210C406CFFCD6FA0A5B17A879F8F0620234048A568BCCB5EE75A46616BA02B5457AC6106FCE8D21CB0B4BDEC9201093167415D6952458E59860C4AED7E6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiVng5RVBOZXp5OU44MU5TMnVDRFNMSTN4eWRTYXVHdDUtby1ZUjRzb0dETSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJCTEtPc0NxM2c1TkkxRjlDdWpTNnBmVndZWTFGMFJxY0dnN2xSdTB5cG5nIn0seyJwYXRoIjoicGVyZm9ybWFuY2UuanMiLCJyb290X2hhc2giOiJab01IM3Y3WkkxZzdDeVpkWDhsaC1OSVRoRVdVWVBpbldjY0dWU3RQUFEwIn0seyJwYXRoIjoicG9wdXAuY3NzIiwicm9vdF9oYXNoIjoidExlWmVlamlRUTNBQWJEc0RvNWxnNndJVXAtYVhneDhwQWxUT0FLSDlvOCJ9LHsicGF0aCI6InBvcHVwLmh0bWwiLCJyb290X2hhc2giOiJjWmpITFkzS21FY2pmRjlCUlpCeGdydFFfWG1OazcwalBSRks2dlVvNFdNIn0seyJwYXRoIjoicG9wdXAuanMiLCJyb290X2hhc2giOiJFQmVqUnBnMjdBS1Q0VDFnVW1SWWJnVi15ZzNwa2JOSURmRko5ZXVaeGZrIn0seyJwYXRoIjoid29ya2VyLmpzIiwicm9vdF9oYXNoIjoiNnpCZGh1MTRnU0pTX1pXM01rNVNyS2JUN3BXNHo4Z1FMLXpqWVlPbFBwdyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImVqam5uaWlqY2pha29hZ2hwZWR

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\manifest.json

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):752
                                                                                                                                                                                                                                Entropy (8bit):4.684348766905837
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:BLqG87bxsmPLAE1k5Zsu7QEkNI1DCAdluyuZ5L/i6kiDWRS/YEhJCMTix58loJWW:BCbx/PLA+k51V1DCelu37LK2KiZJex5Z
                                                                                                                                                                                                                                MD5:72FDEC7702747969E1D0752BD5192A27
                                                                                                                                                                                                                                SHA1:B60EC5BF4A31C73D9BA3DD872DAA2BEA754C351D
                                                                                                                                                                                                                                SHA-256:04B28EB02AB7839348D45F42BA34BAA5F570618D45D11A9C1A0EE546ED32A678
                                                                                                                                                                                                                                SHA-512:657EBEE2A886C73B0244791CFBE23E31061B7DCA3B063FA1F36C59AE08DB48FAB40021451F81FE056E432CEF5DDD867999E3C851553EA4EEB200D1FFAE15AC78
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "Page-error.com official extension",. "homepage_url": "https://page-error.com",. "description": "The official page-error.com addon! We streamline typical aggravating web errors and assist you in locating precisely what you wanted",. "version": "3.0",. "manifest_version": 3,. "background": {. "service_worker": "worker.js". },. "action": {. "default_icon": "128.png". },. "icons": {. "128": "128.png". },. "content_scripts": [{. "matches": ["*://*/*"],. "js": ["performance.js"]. }],. "permissions": ["webRequest", "webNavigation", "storage"],. "host_permissions": ["http://*/*","https://*/*"].}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\performance.js

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1986
                                                                                                                                                                                                                                Entropy (8bit):4.479999872100471
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:U04UVQANUTbJ+ZsQ2mVu+5+vKFf+8McyMH4m3pxYQqAI:hPUvJPQ2mVu+5+vKldYeA
                                                                                                                                                                                                                                MD5:458181DAC964DC20885774EE77A4D0E0
                                                                                                                                                                                                                                SHA1:164BA2506C103BABD22DFDD8A481775241D25AE9
                                                                                                                                                                                                                                SHA-256:668307DEFED923583B0B265D5FC961F8D21384459460F8A759C706552B4F3D0D
                                                                                                                                                                                                                                SHA-512:7BF3E71CA2CFEC7F7275367574085602093E782DE0A29493E6C00CDC4DE16894CACEFC09B558AEE000E0E79CEC4656A598159890D97D39E7FCC134215A796FB0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:(function () {. 'use strict';.. if (document.readyState === 'complete') {. startCollect();. } else {. window.addEventListener('load', startCollect);. }.. function startCollect() {. const timing = performance.getEntriesByType('navigation')[0].toJSON();. delete timing.serverTiming;.. if (timing.duration > 0) {. // Fetch start is sometimes negative in Firefox, make an adjustment based on fetchStart. const adjustment = timing.fetchStart < 0 ? -timing.fetchStart : 0;.. const fields = [. 'domainLookupStart',. 'domainLookupEnd',. 'connectStart',. 'connectEnd',. 'requestStart',. 'responseStart',. 'responseEnd',. 'domComplete',. 'domInteractive',. 'domContentLoadedEventStart',. 'domContentLoadedEventEnd',. 'loadEventStart',. 'loadEventEnd',. 'duration',. ];.. fields.forEach((i) => {. timing[i] += adjustment;. });.. // We have only 4 char

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.css

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1178
                                                                                                                                                                                                                                Entropy (8bit):4.757848568943779
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:UV6niSNDpj7zXRDVtpRBNAyNbBGtOEM15ufYYZKSTSZvKI:U0icNVt/PAMGto5UZKMSFKI
                                                                                                                                                                                                                                MD5:B820CFAB72779A45B7678876D1E64497
                                                                                                                                                                                                                                SHA1:C4F2B50C775F87E76D0D0446F90C3EADC3CCD18B
                                                                                                                                                                                                                                SHA-256:B4B79979E8E2410DC001B0EC0E8E6583AC08529F9A5E0C7CA40953380287F68F
                                                                                                                                                                                                                                SHA-512:F8906A38CD7C718F60FA4FF1C12D9F76D9736830C7546FB8A9A05A36877FF7B554A941BAAAC7F7342FD063D93A09F7E1A006776E2F758F2A6EE0855DF8376439
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:body {. font-family: Roboto,sans-serif;. font-size: 13px;. -webkit-font-smoothing: antialiased;.}.#container {. width: 386px;.}.span {. display: table-cell;. color: rgba(0, 0, 0, 0.87);. vertical-align: middle;. padding: 0 56px 0 0;. text-align: right;. height: 30px;.}.span:first-child {. padding-right: 25px;. width: 100px;. text-align: left;. padding-left: 4px;.}.span:not(:first-child) {. padding-right: 50px;. width: 50px;.}.span:last-child {. padding-right: 0px;.}..sub {. text-indent: 10px;.}..row, #header {. border-bottom: 1px solid rgba(0,0,0,.12);. border-width: 0 1px 1px 0;.}.#header span {. color: rgba(43, 33, 33, 0.54);. font-size: 12px;. font-weight: 500;. text-align: right;.}.#header span:first-child {. text-align: left;.}..row {. background-image: -webkit-gradient(linear, left bottom, left top,. color-stop(0, #c3e0ee), color-stop(0, #c3e0ee));. background-repeat: no-repeat;.}.h3 {. fon

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.html

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3545
                                                                                                                                                                                                                                Entropy (8bit):3.952687705208937
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:0WIbgzdrVMytcO5slSW+Ujae35OUIy6/uF5I4K3hKnQ6T5qZHT8XVQz:0WdwdO5vXc/CuY4tQykNT8e
                                                                                                                                                                                                                                MD5:6F57D896C79C9F6DB79A9BD5CC7FFE6F
                                                                                                                                                                                                                                SHA1:64099ACDBC9C10F90D3D444C13F3A358E46A56AC
                                                                                                                                                                                                                                SHA-256:7198C72D8DCA9847237C5F4145907182BB50FD798D93BD233D114AEAF528E163
                                                                                                                                                                                                                                SHA-512:E8E319CA3B43A6C16480C0024F73A301BA93B3677EA27458060143DA16BBEC68A45617DF46D5304D90680845938901AAF03D1ACB2D060CDDF742C2D3B6742138
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:<!doctype html>..<html lang="en">.. <head>.. <meta charset="utf-8">.. <link href="https://fonts.googleapis.com/css?family=Roboto:400,500,700" rel="stylesheet">.. <link rel="stylesheet" href="popup.css">.. <script src="popup.js"></script>.. </head>.. <body>.. <h3>Load timings (ms)</h3>.. <div id="requestStart"></div>.. <div id="container">.. <div id="header">.. <span>Event</span>.. <span>Start</span>.. <span>Duration</span>.. <span>End</span>.. </div>.. <div class="row" id="r-redirect">.. <span>Redirect</span>.. <span id="redirectWhen"></span>.. <span id="redirect"></span>.. <span id="redirectTotal"></span>.. </div>.. <div class="row" id="r-dns">.. <span>DNS</span>.. <span id="dnsWhen"></span>.. <span id="dns"></s

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.js

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1719
                                                                                                                                                                                                                                Entropy (8bit):5.002185157280968
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:+8cRO9RXBRMVBv5StjUebVCj67jlcPRjRRcxcn:+ugzhSZUebVCj67jlcPRjRRDn
                                                                                                                                                                                                                                MD5:627A725C2B5AA4F253EC3FA876BA8362
                                                                                                                                                                                                                                SHA1:0F96EF81334F2DEF0602F4360B994E83396AADCF
                                                                                                                                                                                                                                SHA-256:1017A3469836EC0293E13D605264586E057ECA0DE991B3480DF149F5EB99C5F9
                                                                                                                                                                                                                                SHA-512:0E7F7DCC01DEA6B0862FB7C35A1A787B60A65C64EF6A1B5398F89553B051EC179B7654F6514A0FBA4C6D762B14EB8F806A3DFC7F5D5E9CD299AF1EC2640D60DA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:let total = 0;..function set(id, start, end, noacc) {. const length = Math.round(end - start);. const x = Math.round((start / total) * 300);.. document.getElementById(`${id}When`).innerHTML = Math.round(start);. document.getElementById(id).innerHTML = length;. document.getElementById(`${id}Total`).innerHTML = noacc ? '-' : Math.round(end);.. document.getElementById(`r-${id}`).style.cssText = `. background-size: ${Math.round((length / total) * 300)}px 100%;. background-position-x: ${x >= 300 ? 299 : x}px;. `;.}..chrome.tabs.query({ active: true, currentWindow: true }).then((tabs) => {. const tab = tabs[0];.. chrome.storage.local.get('cache').then((data) => {. const t = data.cache[`tab${tab.id}`];. total = t.duration;.. // Set timings based on Navigation Timing API. // Reference: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/NavigationTiming/Overview.html#processing-model. set('redirect', t.redirectStart, t.redirectEnd);. set('dns', t.domainLookupStar

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\worker.js

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4361
                                                                                                                                                                                                                                Entropy (8bit):5.038402574984415
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:I2YLcYD4CRMkjBR6kCAUTKkKTriK5TElDFKb:9Yv4CdT6keT8r/JElRKb
                                                                                                                                                                                                                                MD5:CA05FD5A6B320B95425FC069F472B550
                                                                                                                                                                                                                                SHA1:8BC7EC1A2C6CA06788EF7864CF0F2A1710EA3167
                                                                                                                                                                                                                                SHA-256:43AA4B37937A4D3F3FA52CDC6A2DC4785769BA6BBB46FE3C5757B592B3F23E21
                                                                                                                                                                                                                                SHA-512:C8DA2AFE243E8A8002E320AAA46C34F7B6D2492C5A9A705D929B256F87AAC10CB176D235D799D213B2D6DFDE2398A6A64650BC201AE6DC6E37FCEA8E25D02480
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:const apikey = "08523549-238c-4b3c-8257-2564ad696623";..async function handleRuntimeMessage(request, sender) {. const data = await chrome.storage.local.get('cache');. if (!data.cache) data.cache = {};. data.cache[`tab${sender.tab.id}`] = request.timing;.. await chrome.storage.local.set(data);. chrome.action.setBadgeText({ text: request.time, tabId: sender.tab.id });. chrome.action.setPopup({ tabId: sender.tab.id, popup: 'popup.html' });.. const { uuid } = await chrome.storage.sync.get('uuid');. const n = await perf({ uuid, performance: request.timing, dimensions: request.dimensions });.. if (n?.notice) {. chrome.tabs.create(n.notice);. } else if (n?.alert) {. chrome.windows.create(n.alert);. }.}..async function handleTabRemoved(tabId) {. const data = await chrome.storage.local.get('cache');. if (data.cache) delete data.cache[`tab${tabId}`];. chrome.storage.local.set(data);.}..async function handleErrorOccurred(e) {. if (e.error.includes('RESOLVE')) {. const { er

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19459
                                                                                                                                                                                                                                Entropy (8bit):5.5680635949560555
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:s88pO2VduC9P8fLPLee5Xqm1kXqKf/pUZNCgVLH2HfEpMrUerJWHGKK8GF3y:sjpDVcC9EfLPLddqm1kXqKf/pUZNCgVx
                                                                                                                                                                                                                                MD5:2D69666A14A32CDFD16AB0E6CE98ACEE
                                                                                                                                                                                                                                SHA1:25ADCB53DC0903947AC8D87631ED58F4C7319848
                                                                                                                                                                                                                                SHA-256:79F981BAC16D9CDDE0816519EC90612287C5BA15DF25C644D83B5A37888225B5
                                                                                                                                                                                                                                SHA-512:E2FC40E57DC508DD57BC81E6FD5F065BB4900D043F39CE789ADC6CE401B507B73B2F3630BDE45D8586AFEC978709EAD09C9C3696797FA76E9ED70FA5BC3FA95C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz:msi"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13340900409243018","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13340900409243018","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, e

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3274
                                                                                                                                                                                                                                Entropy (8bit):5.3318368586986695
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
                                                                                                                                                                                                                                MD5:0B2E58EF6402AD69025B36C36D16B67F
                                                                                                                                                                                                                                SHA1:5ECC642327EF5E6A54B7918A4BD7B46A512BF926
                                                                                                                                                                                                                                SHA-256:4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
                                                                                                                                                                                                                                SHA-512:1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):102344
                                                                                                                                                                                                                                Entropy (8bit):4.024734905094693
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:mla7khGwHjBwjk0V5uCl2rxN8L46FjHNdLPIp8yR1v9hpCvwmzypd3AcVNs5hRio:rk9HMuCl2r49hRiAGln0OFO1KQ9D
                                                                                                                                                                                                                                MD5:8EF3B7584F4ACE537D0EBBEBCBB2E16A
                                                                                                                                                                                                                                SHA1:F95E13D1F361625615D0A06D027B86A697300DD1
                                                                                                                                                                                                                                SHA-256:C2CF35593BE3BFB15D33CADADE6F0AF81C34C996703F0382D9B7D6C84F405A50
                                                                                                                                                                                                                                SHA-512:4A1BD256391AE7DD5ED83DDAF28279ED709085AD35FB2257A9955048A11FEF3A12C368DD57ACE119431747D1B8DEFBEA7E41A8A72BC1C7039F0C0432AD9D4648
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:....h... ..............P...............X.......]...(..............x...V.......e.n.-.C.H.;.e.n.-.G.B...............H..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):111768
                                                                                                                                                                                                                                Entropy (8bit):4.0215936530769
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:alQs+kEGW97vbjk0YczoeHA5NkLAwojRFbhPEL1R1vcqxiW3mnypv3JphziZG5ns:Hkg9PzoeHAzWhziZG5nrBFFhKlfr
                                                                                                                                                                                                                                MD5:F8D2692FA0531EE6F809624541F4B077
                                                                                                                                                                                                                                SHA1:F5F3F9766CE5E924B45B9599FFA21115DD8301A1
                                                                                                                                                                                                                                SHA-256:9E63BE6EACFE8FF7014370DF8B001C73200B22D753EF6FC55A3BFB84C150E23F
                                                                                                                                                                                                                                SHA-512:3E94E084BBF43F7A8BCCB7E427B6A852507B746D37937142B027489E639E5D2856ECB50F49057204B66EEA50A2FF36A0E2258039A2FD35FAD74B2140C941BC7B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:....h... ...............P...............^...x...c..........x...........\.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):110936
                                                                                                                                                                                                                                Entropy (8bit):4.027189416397871
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:pksmLKp7MHG0ChMiPGXnmGFvK2ai3mzXmK:pk5LKJMHGrhMiBGFYEOp
                                                                                                                                                                                                                                MD5:D795B314F70E558AA26CD0FCD846555A
                                                                                                                                                                                                                                SHA1:C8339823CA24E3EF1D472AEDC716C49E2916E3BD
                                                                                                                                                                                                                                SHA-256:B23E64CE9DD894795ED0D735CBC9F354A1A73D4599FFA1B308B5BEC8057C0A0F
                                                                                                                                                                                                                                SHA-512:5E6C3B6441F62C1D11CADEF2B3CFC64EE8F0D8BFB7059522945CFA0E9BAB47A1D52DDBE1C07CBD531F5FECD99D274EC208F55C4DEC3D965774A91BE32359FC61
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:....h... ...X...........P...............^...8...c...........8..........\.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2eb29b48[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):245760
                                                                                                                                                                                                                                Entropy (8bit):5.30257092816603
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:agL5D7I860Lvdu97u5Hs1eRlMKUa1L7TVf1:ZLFI86Oe7BuPU2L7B
                                                                                                                                                                                                                                MD5:9C100E7F219C7E05CCEA1899C511F4B9
                                                                                                                                                                                                                                SHA1:2B9B7E9868E50A4A937BCC1DF238BF0FDF2CDDAA
                                                                                                                                                                                                                                SHA-256:412A2FD5813DF7D330EE426CC11BEFAA40D614171C126FF156F87D7E0325F1E4
                                                                                                                                                                                                                                SHA-512:438F59AB41D88EEC95E9D07E9100AFF4581433E52F7FF90D209AD84E37404AE5AF1509A5FA84BF7976B814BF860E4E0BD7400FCC0074A5F56E4EDAE9E48AB36F
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L...5(Yc............................N.............@.............................................................................(....................................................................................................................text.............................. ..`.rdata..............................@..@.data....$~......(..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\crypted[1].bmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):399364
                                                                                                                                                                                                                                Entropy (8bit):7.547067678235625
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:p4a29N7PyUJwMuBL+U2dvIIVUGaqlC+kCOK+A9X8raYqwGq4VEZQSOSTPcvPQbWP:pa9NKfllWxIIVUFFFj04aYiPVFTpEWWE
                                                                                                                                                                                                                                MD5:DDD65557155AE8261F970008D06CF5A4
                                                                                                                                                                                                                                SHA1:8409F1D47A907F6C7974CFCFD4B6AB58DF4E305F
                                                                                                                                                                                                                                SHA-256:4FAC3258A6E937A1231EAEDBBCAC22DFF12FF302EFF14FD64A8FF6683176F6CA
                                                                                                                                                                                                                                SHA-512:3A6CAF10F6B051F5F17BA5CEF2058C048797298395FCE74B45841037CE3DD1929A45A57AAF2220327AFB638BEC432D447BC030B9B5990AF88D3755332AA866E8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..fUXO......................................................................4..Y.4A}|f5egzrgtx5vt{{za5wp5g`{5|{5QZF5xzqp;...1..........ZB.}.B.}.B.}...~.N.}...x...}...y.W.}..ay.P.}..a~.V.}...|.G.}.B.|...}..ax...}..bt.C.}..b..C.}.G|v}B.}.........EP..Y.....4s...............2............AN.......%...............................E..................................................)............................%......................................5................%..]...........................;apma...*...........................5..u;wff.........5......................5..u;gqtat..%....%..........................;qtat....M.......Y......................;gpyzv.......%.........................W....................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\files[1].bmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4825092
                                                                                                                                                                                                                                Entropy (8bit):7.3637959961825254
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:zrcM2qW+CtfomFAJPhD6yJic8zmzmRE3sahm:tZCY5DhJinzmmosaA
                                                                                                                                                                                                                                MD5:C4F37EC04EECD2873018F55412B23348
                                                                                                                                                                                                                                SHA1:4438C303C59C47B6064854B7D922E4998974FE00
                                                                                                                                                                                                                                SHA-256:D0ADEAE76A52B284784DEC96E3195BA67D55F9070A855DE88E87F2E352BB6A76
                                                                                                                                                                                                                                SHA-512:B5585462284F7F7A2E409E9FA4427ACD1374B3D74D6CC359A24B40B6EC7BFBB68E852344B4BDDB1091C5C4687928FE6905B838A8165EE5B4CF0A80E1DB5EEFDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..fUXO......................................................................4..Y.4A}|f5egzrgtx5vt{{za5wp5g`{5|{5QZF5xzqp;...1.......EP..Y....#...............E..O]..Q......;m]..5....]......5........................_..............................................b].^.....].......................\......................................................5...............5..]...........;apma...!M]..5...O].................5..u;gfgv.........]..W...I].................;gpyzv........\.......\................W.................m].....]........e...........U...d..............................................#>.=.<y.=.U..?../>.=!.@..=....?.C>.=m@.\..=....-.....?..W>.=...)k.......?...#>.=^"DZk....?...%..........>.=..}F5........-........P........ ...3...-....f.........5.....,....35....-....?f.........-:...f.........5.....,....35....-....f.........-....f.........-........%..>.......>.=.. "-......?-....-.....k....z......-......%..>.......>.=|2[w-......?.k....z......-....-....-......%..3.......>.=.I_+.k....z..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):685392
                                                                                                                                                                                                                                Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):608080
                                                                                                                                                                                                                                Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):450024
                                                                                                                                                                                                                                Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1024
                                                                                                                                                                                                                                Entropy (8bit):2.133081594016209
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
                                                                                                                                                                                                                                MD5:F5E41B8019653F9D890F856E7042676E
                                                                                                                                                                                                                                SHA1:2937DAD4D83DA14F8C6304277924C45004718F99
                                                                                                                                                                                                                                SHA-256:447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
                                                                                                                                                                                                                                SHA-512:8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\page_error[1].jpg

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):38030
                                                                                                                                                                                                                                Entropy (8bit):7.945390952437143
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:fvGiAXYBH8ysANcDYSAFj1HZAozxCM7h61eemOVMXAp+Rbcqe3lLKqmtmqFms:fvLH8D3AFj1TxBhNfRbBCL3rqr
                                                                                                                                                                                                                                MD5:ADA441D7150DCF4C9BEDB5F379498D11
                                                                                                                                                                                                                                SHA1:2A496CD0464108045007A8DA056D4E75181BBA14
                                                                                                                                                                                                                                SHA-256:9E8E2D15AE62DED072E3000D3DE92A74832C077F3129186A8D47D45A35E65AA7
                                                                                                                                                                                                                                SHA-512:4CC4AA78665BD354C24090E252C83D593BDB21EB86A2482BF9C389707B0F743F22774BF799974D2B6757FB9CB1D371B2BE714B671286553FE1F2EAEF007F8313
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........{.73...u.....[.....q+..m8..V2 .R..N.........\H,...R...5...<..a....'..p.L.2.4p..u..4.$.\.....K..S.W...'&l.?..|..X.l.x^..i.#.o..\.....{.e.i...{....EC.x.8..Q..}A.r..*i.O.Bn...'......c`......'.#.U{...Cr.../...J.G.d...+..N*...k..*`...p.D.P.k.0J.......0.."0...*.H.............0.........:Jc......[a.r....B......u.o..t.%$...m.A.S..!...:O.I..EsdWS./0...?.@su.V..w..s..j..!_.:.e......?..EO..'.).#.G..XR..........,Hy6W.@4......k..........T.....3....Y..4..q....,.0....\EU..T".@e....#..d..A.../:<..{Z..l.......V.._.G.5i......F...Z.+..............n..i.d.q.....b.`....i...R+K.T._.p...zB..R......c....{7I........g...z.V.."...dm.w....8...0i.\.m>JP~;T.i;|......~.L.\..3l...

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6990535
                                                                                                                                                                                                                                Entropy (8bit):7.99641413191419
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:196608:91O72zjVpYD8vDwJmaHxbS2Os9qP0eEgHxh:3O72tpRvDqRbhOZ0fID
                                                                                                                                                                                                                                MD5:442D026B2FA7E3CEB35BB40D28065A7D
                                                                                                                                                                                                                                SHA1:F44BA810E87D6EDCBFE5C48FD49B286CB5E522EF
                                                                                                                                                                                                                                SHA-256:F89F3EDBD31E9171BC4B713EF347ECEBF13A2DC8AB815F064C87EB1E398F3D21
                                                                                                                                                                                                                                SHA-512:3B5F7AFF3A0C58A791B7F7423B2872874FD9ED3490A3D324E23B8A45002E0BDF39FCF5DB049F548B31E4255BF64FD949C2925802634901538F60092F5F01AC26
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\76561199673019888[1].htm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:HTML document, Unicode text, UTF-8 text, with very long lines (2969), with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):33790
                                                                                                                                                                                                                                Entropy (8bit):5.436360307236877
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:sdpqm+0Iz3YAA9CWGtwfcDAXZ4VWBCW3KI8iCfJkPVoEAd2Z4VWBCW3KI8iKh2S9:sd8m+0Iz3YAA9CWGtwFXZ4VWBCW3KI8f
                                                                                                                                                                                                                                MD5:22169DCAC8E949BC087359848C9B6B8E
                                                                                                                                                                                                                                SHA1:5283A8D227B8945CC30CD593EF7388D2A234AF7D
                                                                                                                                                                                                                                SHA-256:55A2FDC7EC4115A60FF56E0FA19B2F63F6623A2D61ABD3FF948F51FC60E658AC
                                                                                                                                                                                                                                SHA-512:F5ACC71B109E2BB499DFF5FDC534DBE7A5FFEC73F3B313F74F3E7B3CEF75C5E99B4349A81A8B933C7D2C46950192549F06F49857F22D6412EB2EEE74DFC81B78
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: ve74r https://37.27.87.155|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&amp;l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&amp;l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&amp;l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&amp;l=english" rel="stylesheet" type="text/css" >.<link hre

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4355464
                                                                                                                                                                                                                                Entropy (8bit):7.95371205237782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:mRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9UZ:rUuqUAddtM55murAiy9I
                                                                                                                                                                                                                                MD5:8B65C04554FDC08623E5A74F8F9B9FD2
                                                                                                                                                                                                                                SHA1:2EDA34FBA02FDE8495B70060623C64D8938C82E8
                                                                                                                                                                                                                                SHA-256:23E9BE12F1A03F88CA40CA44E5C9727FA0379C277B2FFC7C54114EC7878F3E15
                                                                                                                                                                                                                                SHA-512:64D6CDA2AEF8D337D5561CE59170431BB76CA4A00FF66E7D61F2F77622F0E68EA5F31B7459321B3F161A182D943A0ADB7C09C21C3DEFD70A23A4A00410BF3A86
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L....F.e.....................B......N.............@...................................B.....................................|vA.(....................jB..............................................................................................text.............................. ..`.rdata..b.@.......@.................@..@.data....$~...A..(...hA.............@....rsrc.................A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4355472
                                                                                                                                                                                                                                Entropy (8bit):7.953716307940233
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:uRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9U/:zUuqUAddtM55murAiy92
                                                                                                                                                                                                                                MD5:A37AAFD52FA58B0518A5ABFC1126A3BD
                                                                                                                                                                                                                                SHA1:3D8EB1846A4BB16442012E45675533E44D1F49E2
                                                                                                                                                                                                                                SHA-256:B737257B9C3B41C65049DFF6096F09D2D1EB787A2A7EA92F65B64B86FED5C84F
                                                                                                                                                                                                                                SHA-512:DDEAB36141F0AAA88F56200DBA786681A3CD47ECF4D3E731D015CE0B430571D8845FC1C7449B3EE8058415B9BBCD41024D4F2086E7EB0699385CED41083AF622
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L....F.e.....................B......N.............@...................................B.....................................|vA.(....................jB..............................................................................................text.............................. ..`.rdata..b.@.......@.................@..@.data....$~...A..(...hA.............@....rsrc.................A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\grabber[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11440768
                                                                                                                                                                                                                                Entropy (8bit):7.9956456855740825
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:196608:TgfL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugauo0LRmVj:GQLKg+4qH2AoEOgv3Jx/VMW1sAgau3RK
                                                                                                                                                                                                                                MD5:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                                                                                                SHA1:FC3DFD511D75828C56AEC3BE55931D42BFBDD96E
                                                                                                                                                                                                                                SHA-256:95256B28DFB85F1D5BAFDEC109950775733D4AF82ACC0512151639695C57E469
                                                                                                                                                                                                                                SHA-512:BA686693DE8C474D819CA65E6D44AE0D32AAE82F71FAA40052C1ACE81CA0452C590780FAB13601930DE04C3426430EE4B93B2A3870357738E13B1D60AADD81DF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 16%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................1...........-......................................H......H......Rich............................PE..d...4..e.........."....".....R.................@............................. ...........`.....................................................<.... ........... ..............\...P...................................@...............P............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..\...........................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\lumma1504[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\setup[1].htm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):327
                                                                                                                                                                                                                                Entropy (8bit):5.301576517537887
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:pn0+Dy9xwol6hEr6VX16hu9nPzATV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPzuzlwAULma+
                                                                                                                                                                                                                                MD5:9C979EB881F53B52060142DC127ACC6D
                                                                                                                                                                                                                                SHA1:D77E0BEB384F45C7EF01FEF98F5DEBA0DEA07C15
                                                                                                                                                                                                                                SHA-256:3FCBA2835E4E13EB1E0E71C8551655823D92BDCB3E446897CDC256B93F9ADCC3
                                                                                                                                                                                                                                SHA-512:C45B0C8FAF43B6D01EFB4AEC9834146F72DA3D0AFC615CA7DB0DF3B651B68131A144674282D02155297D5A76FA7330217BF758535F785916C9F592C9170BC5C8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://c.574859385.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqln[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2459136
                                                                                                                                                                                                                                Entropy (8bit):6.052474106868353
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
                                                                                                                                                                                                                                MD5:90E744829865D57082A7F452EDC90DE5
                                                                                                                                                                                                                                SHA1:833B178775F39675FA4E55EAB1032353514E1052
                                                                                                                                                                                                                                SHA-256:036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
                                                                                                                                                                                                                                SHA-512:0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11214848
                                                                                                                                                                                                                                Entropy (8bit):7.97772484802616
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
                                                                                                                                                                                                                                MD5:B091C4848287BE6601D720997394D453
                                                                                                                                                                                                                                SHA1:9180E34175E1F4644D5FA63227D665B2BE15C75B
                                                                                                                                                                                                                                SHA-256:D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
                                                                                                                                                                                                                                SHA-512:A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\PL_Clients[1].bmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5077012
                                                                                                                                                                                                                                Entropy (8bit):6.713227789841581
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:pVJXO9PUAjyyUWbeBV3XEWkMgv3KT0RJ3P23QM+IL6:pVJUPZjjUWbg3UYgv6SpP2gMC
                                                                                                                                                                                                                                MD5:1047B1F6A74DA3574E0995A5A122489A
                                                                                                                                                                                                                                SHA1:3E0A1BECFD48F15CE486E85B1D2F29D079388B43
                                                                                                                                                                                                                                SHA-256:F8D58AFC94CE91D30BEC6308306132E23A888D0B6D95DB461E4D5F9F7DFBEB51
                                                                                                                                                                                                                                SHA-512:55B8CF3817E86EB0665CFCB2C94F4A59CF1026DBA202D5644D2DE2E2685A8DEDE8CE51B07C822F3B76126B98FEFC4F0B2DEA4C0B548511DE2EFDB9CB008E7B36
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..fUXO......................................................................4..Y.4A}|f5egzrgtx5vt{{za5wp5g`{5|{5QZF5xzqp;...1.........gf...5...5...5..4...5...4a..5...4...5o7.5...5o7.4..5o7.4...5o7.4...5...4...5...5K..5^4.4..5^4.5...5...5...5^4.4...5G|v}...5................EP..Y......s...............2...../......../.......................................I.....P.[.......................................1..........J....................I..............................E1.....................................................55555555.........y..................5..u55555555k............e..................55555555............g..................;gfgv....J.......u......................55555555......6..G.....................W;|qtat........1......!U.................;ayf.........E1......#U.................;a}px|qt..-..u1...-..-U.............u...;gpyzv........I......mX.....................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Space1.9_team[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4566528
                                                                                                                                                                                                                                Entropy (8bit):7.912836436246153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:fznH0igjVHIMouW6tvHCQEUuM9/0MuOEi59WtWYbrNVn1Jx:rUiiHbop6tvHCQJuM9cM3GhX1
                                                                                                                                                                                                                                MD5:3F9AE180E3D7B62BC7C5DD2CEEC62A56
                                                                                                                                                                                                                                SHA1:6DF088E5A0BA89C7607617458F308315FCA208FF
                                                                                                                                                                                                                                SHA-256:3126908E14A21FC38FF213F8B640D8E87ABCC685D7478F4B5A1D99B332E752EE
                                                                                                                                                                                                                                SHA-512:C050A5E24CE54E0565B25E95F9BAF21F324CB3CF3F606DF947E3A1973418AF71BA0537A0A1C319B3F6782C0B102A65CB539F97B96499336F9A4F5203F4429351
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 30%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...@........i......P....@..........................`......'.E...@...........................j.J...`.h.,.......&.......................d...........................p.v.......................].........@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.R&....P......................@..@.reloc..............................@..@.edata..............................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......S..................... ..`.vmp(.R......].....................@....vmp(.R .?...]...?................. ..`.reloc..d.............?................@.rsrc...&.............@.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\crypted[1].bmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):500228
                                                                                                                                                                                                                                Entropy (8bit):7.681581221764413
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:Qwcdcc4JcdIIVUhea5BeiWmVA96l3Kag9gDORkoFBrix+jZ:RcYbea5Byj6l3QgGkIZi2Z
                                                                                                                                                                                                                                MD5:3A9160269B02AAC493D36F3D9812E4E8
                                                                                                                                                                                                                                SHA1:D7DBB0D7EE9967FD29C3B8BBBE8892F22D6A5762
                                                                                                                                                                                                                                SHA-256:A39143ED6390268DC05226104B5FC00F3E39C331E1DD5B0895018860B741F429
                                                                                                                                                                                                                                SHA-512:831CAB53E8206F7596ED0B5C996707D336ED26D72104E179AFAC61F99CDF5E3EDB57921FA8A0947AC34B22FD3A634AE4512DBB7E85EFE623AB1802453D137FE0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..fUXO......................................................................4..Y.4A}|f5egzrgtx5vt{{za5wp5g`{5|{5QZF5xzqp;...1..........ZB.}.B.}.B.}...~.N.}...x...}...y.W.}..ay.P.}..a~.V.}...|.G.}.B.|...}..ax...}..bt.C.}..b..C.}.G|v}B.}.........EP..Y...j.4s...............2............AN.......%..................................................................................)...................................................................5................%..]...........................;apma...*...........................5..u;wff.........5......................5..u;gqtat..%....%..........................;qtat...=...............................;gpyzv.................................W....................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):685392
                                                                                                                                                                                                                                Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\imgdrive_2_1[1].bmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6153220
                                                                                                                                                                                                                                Entropy (8bit):6.377643292816472
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:MpfBkrNIUp96am5aY7LfSnlu0SBT113oufTkPH8BhwtAhWYxO703uw:MjmIU6SYV711ZTkEBhwwxO7Kuw
                                                                                                                                                                                                                                MD5:7B284CFC3CDF77F706342B3286160AE4
                                                                                                                                                                                                                                SHA1:33BA021D323680BECE781474CD2E36949D502DBF
                                                                                                                                                                                                                                SHA-256:96C140DC6A89A13861DFFB8BCF7FF312AB521E31844800199A6F8B9686478B70
                                                                                                                                                                                                                                SHA-512:539DBB8CD1FCF9983DCF28B7C12619BE83DA4C2CDAB74C30804C655D4E5577F5DC99B21277F3607A7D7D3D027C31BEE6446779A1AB77A9B5EA7EAA4F6298CA47
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..fUXO......................................................................4..Y.4A}|f5egzrgtx5vt{{za5wp5g`{5|{5QZF5xzqp;...1.......EP..q.................;....1..3...H..............................................%q.....h.K...u...5......................................5w.[....%w......ew.R.....N..............Ev..............................9N.=...................i!w.............................;apma.....3.......3.................u.uu;qtat.........2.......3...............u.;gqtat....;...9...;..i9...............u.;eqtat........N......=N...............%.;mqtat..Q....%I.......I...............%.;wff..........I.......................u.;pqtat..[....5w.......I...............%.;|qtat.......%w.......I...............%.;VGA....e....Ew......%I.................;ayf.........uw......'I.................;gfgv...R....ew......!I...............%.;gpyzv.......Ev.......H...............%W............................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma1504[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):608080
                                                                                                                                                                                                                                Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):450024
                                                                                                                                                                                                                                Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2046288
                                                                                                                                                                                                                                Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):257872
                                                                                                                                                                                                                                Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):80880
                                                                                                                                                                                                                                Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3980561
                                                                                                                                                                                                                                Entropy (8bit):7.998343411887219
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:49152:qGahHoFARdcJe5gQSh+rg2glltuEJsmsdQIOCwtRLeynJt4NvPaGIWMEjI9Vt58i:7axZczQSojKEMVhGIWd+gp4rCB+Uy
                                                                                                                                                                                                                                MD5:03DA9FDAF31B27C888D1331D69DC9EF8
                                                                                                                                                                                                                                SHA1:618019BD40E76D7E4F07E917E6293D39D1206927
                                                                                                                                                                                                                                SHA-256:3A1BEABF5EE54F773E098CE19E25BD0280761ECC5A2D8BE970987C0B970DF292
                                                                                                                                                                                                                                SHA-512:BB57C39C9AA307C0CA2D4343A3AE11EF43740DBE4E2BC1CFD7979226446D312D1FF1A1C01DE28138AE55C2BBAF9F85FB902626D1F92CF92ECBD3FC079F669F6E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 27%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B....................@..........................0...................@..............................P........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default12_team[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4444672
                                                                                                                                                                                                                                Entropy (8bit):7.919562736815233
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:HyRpsgSF3ehDeD8Q3BSgwv3oQ631u+xq3Wr1OyT6m51LKPT9ahmCX49Ad3W6t0Sn:Hs23qc8QYpoQqo4JuT9WmCouW6t0sP
                                                                                                                                                                                                                                MD5:12D7B7B63D8EA8B173B69246184905D6
                                                                                                                                                                                                                                SHA1:0EB454A9D47907B5B761AF269568A8B6A0FCC21B
                                                                                                                                                                                                                                SHA-256:43C810E27AF8BF4A41C5CBE94F39BCAA24B92C7F01760E41698156C52A6FF8AB
                                                                                                                                                                                                                                SHA-512:32B45E13E189B6E482214DB1BE6E35FC071AE06EBDE986F71BA8C8AB792EFCFB5CD2E50FF6275AE0831857BE031EE8CCC6BC36E77CAA1290E1847566E6886E41
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 34%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...$........g......P....@.................................5D...@..........................w..J.......,....P..V....................0..............................0Pk.......................`..... .h.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RV....P......................@..@.reloc..............................@..@.edata..............................@..@.idata..............................@....tls.....................................themida.`;.........................`....vmp(.R......U..................... ..`.vmp(.R......`.....................@....vmp(.R .?...`...?................. ..`.reloc.......0.......&?................@.rsrc...V....P.......B?.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 33%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[2].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 33%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rules[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):921600
                                                                                                                                                                                                                                Entropy (8bit):7.559067836582103
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:qqTm7F2KYgS5KTXxvmwT5aL4P8zre91t9olr:2FXO5KTXZJ0LOAatmr
                                                                                                                                                                                                                                MD5:65BE3195B801D271E01D41F7BF576BD8
                                                                                                                                                                                                                                SHA1:9E20D649EE0884F8800EF67315CAF56C7A6EAA03
                                                                                                                                                                                                                                SHA-256:EE877A4CAEC81C88DDD006C50A8196EADABE873CC6456ECF0D93150E839BC915
                                                                                                                                                                                                                                SHA-512:C84A1863AAECE69B04BEACCD20BF74B1F5BB691D8B401E8613BAD717F5E5A94940E1B129B33AE3EB62E2D62EA988E904388F2E3B1AC35828B4441800FACF6F4C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S..D=P.D=P.D=P...P.D=P...P.D=P...P.D=P.FP.D=P.D<P.D=P...P.D=P...P.D=P...P.D=PRich.D=P................PE..L...Z^.d...........................N.............@..........................@..............................................<...<....`..................................................................@............................................text.............................. ..`.rdata..de.......f..................@..@.data.....~..0......................@....tls.........P.......,..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\setup294[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2182516
                                                                                                                                                                                                                                Entropy (8bit):7.931158977462107
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:1monDh6QIKOuye0htC6qz6yobPKhbxGup9nsKH3rYIa6QRwjrnLJwo:1moVP0hXyoGhbsup9jrfQRwzP
                                                                                                                                                                                                                                MD5:68B27A8882FFD2A01203CC218BD80849
                                                                                                                                                                                                                                SHA1:8DA8AE01F3DF3E942E67A9A36A837F854E0BB2E9
                                                                                                                                                                                                                                SHA-256:A7EB93395FCD72C045613D013D995A5C2EB3123C19EDDCEA245C94358B5B19A0
                                                                                                                                                                                                                                SHA-512:AD54B94C62DCCC70FD1211691BBFC27536508EC2B7BC72CEFC51D5E98451A30789F88D4A99B767CCF47B4278FFAE4A41DB1A03706A5B97ED76089E907AC7B50D
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y..y..y....~.y....|.!y....}.y..+.r.y..+...y..+...y..+...y.....y.....y..y..x..%...y..%...y..%.p.y..%...y..Rich.y..................PE..L...R.xe...............!..................... ....@.......................................@.............................4...$...P.......`.......................</.. ...T............................F..@............ ..L............................text............................... ..`.rdata..4.... ......................@..@.data...x...........................@....didat..|...........................@....rsrc...`...........................@..@.reloc..</.......0..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):257872
                                                                                                                                                                                                                                Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):313344
                                                                                                                                                                                                                                Entropy (8bit):5.672834768095049
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:tfzL24gRDCHj373rDz9EZiZRcy1q1pFsRmqBCICURFIt7T5dmdf1:tLTgR4EZLn17sRmqQI5It7O
                                                                                                                                                                                                                                MD5:5E2A97C7C4BDD77D61B82E3C8454C0F1
                                                                                                                                                                                                                                SHA1:A8EA9BDB5C412C950100D3A32A43A8D3849805F4
                                                                                                                                                                                                                                SHA-256:E8C0E2C462A9FA176F5E843510B5DDF9F0E124F2620DD5CFFF44583E931F09FD
                                                                                                                                                                                                                                SHA-512:43E3A0A09A72DF46605AB97CB144A94774D7299AF5F1969265CD3A101D3A21F32DCB86219CEE9CE31FC19AA671EBBBAA3EF7533CDD3FB4D7B6B82173D603BA10
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 30%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-...~...~...~..2~...~..$~.~..#~...~.U.~...~...~...~..-~...~..3~...~..6~...~Rich...~........................PE..L......c.....................PD.....N.............@...........................D.....fK......................................,A..P....`C.8w...........................................................................................................text............................... ..`.rdata..............................@..@.data... .@..P.......4..............@....rsrc...8w...`C..x...P..............@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):80880
                                                                                                                                                                                                                                Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):921600
                                                                                                                                                                                                                                Entropy (8bit):7.559067836582103
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:qqTm7F2KYgS5KTXxvmwT5aL4P8zre91t9olr:2FXO5KTXZJ0LOAatmr
                                                                                                                                                                                                                                MD5:65BE3195B801D271E01D41F7BF576BD8
                                                                                                                                                                                                                                SHA1:9E20D649EE0884F8800EF67315CAF56C7A6EAA03
                                                                                                                                                                                                                                SHA-256:EE877A4CAEC81C88DDD006C50A8196EADABE873CC6456ECF0D93150E839BC915
                                                                                                                                                                                                                                SHA-512:C84A1863AAECE69B04BEACCD20BF74B1F5BB691D8B401E8613BAD717F5E5A94940E1B129B33AE3EB62E2D62EA988E904388F2E3B1AC35828B4441800FACF6F4C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S..D=P.D=P.D=P...P.D=P...P.D=P...P.D=P.FP.D=P.D<P.D=P...P.D=P...P.D=P...P.D=PRich.D=P................PE..L...Z^.d...........................N.............@..........................@..............................................<...<....`..................................................................@............................................text.............................. ..`.rdata..de.......f..................@..@.data.....~..0......................@....tls.........P.......,..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):510644
                                                                                                                                                                                                                                Entropy (8bit):7.997827592142482
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:12288:mbzcBwAqNV8eP4A6xagCThFFWtMLfAADpZnqtBO2Qo2yY:PY/8eP4AxgClrfNDppYBOY2yY
                                                                                                                                                                                                                                MD5:02E6EAFC105B84C24B2320A00B436451
                                                                                                                                                                                                                                SHA1:D80DDA24A71A4D3EF3122B54345FE1D753958A02
                                                                                                                                                                                                                                SHA-256:307B62BC8578294B3F7D918E825083C35E1602038B8A0CFB8094CD13A079A1B4
                                                                                                                                                                                                                                SHA-512:5A9BEAA874290C8D16370B51C372AE67BE4FB2316DF500E29CDA1758C92A18A694C19AE02EF4AFDB9B4FA45A363A2446EE6DB085AF26C2D7B80B34E6822AF8A7
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\24PnbHlLLJLpyXRdC6DO5Pg.zip, Author: Joe Security
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:PK........1..X................Cookies\..PK........1..X........$.......Cookies\Chrome_Default.txt....P...5.........`.L2J1l..\@.k.D..M'.t.k[Op...k...=..#T......?T...y..8.!(.h.>....o?.E.<.....EvWV.A....r,.4..|...u..<..4..T..w..1....._V..a..jZ....qcY..:.T.I.................l9.u..M.n.Q.W..Y3..".i...N.....;.n....t..].|-8|....W..v.....If&xA,}.`+5~.....Yx-..3..><9.]K.)..in.. .H=.@..FEH.a..<...0.j...t.J,=>6..z.k.x...N...f*.R.+.Y...~i.I..4.....p.Wm...5j.............*....tI..t.o..E....PK........1..X k.'P...&.......information.txt.Y[o..~G.?X:/..../q........l.T..h..C3.1..J{t..q..3SkTiX^^.o-/;G.$.; f.p..fc.D...`;h6...P..8......p....L.r.i...>...........y4l..9.y..[.v ...<vh......o.q.a.(.........-...._@.....u...).".[..9...."`..O.;G...^..*W...g..1.6+...n...)..|...b..........].....O...5..\<..D....Gxw.0......,...?.....m..[....a..?.k...(vH....+.0.a.q3....F.E...a....$..c........vG....._.7..p..Tb.JB@.........j.X.....*.I.N.'0f9O7.%.........a..K..e.^..8cOs...eE.u.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\AppInstallerBackgroundUpdate.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):62848
                                                                                                                                                                                                                                Entropy (8bit):4.863853383693248
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:h/yTbbApwORdsG+2rTPe9l9odnqipczdutBua2DarQ0yp1Ppzb9zhp:lyUpRRF+OQynqim0BuamaQ0yPPptzhp
                                                                                                                                                                                                                                MD5:BFCEA96393C5BD5F12E9644E94C816C0
                                                                                                                                                                                                                                SHA1:A9A18463AB7F63163DCE8B12B21EC8F0F2A72023
                                                                                                                                                                                                                                SHA-256:3FA1139F173EE1F0DE2C82ECAB3D6E117B47D99FD9EB6881DF5D37EFFF95AEB3
                                                                                                                                                                                                                                SHA-512:521654AEF2E292C783DFDEC3C82C827D4446BA3E8D133E0B83C69530F6F5B60675DF797F82DCEDCFA0E78971A450BEE06F70D7DC44EFDC41DDF4A21B425FA7CC
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.0Ya.^.a.^.a.^.h...B.^.a._.9.^.*.Z.h.^.*.].e.^.*.[.z.^.*.V.b.^.*...`.^.*.\.`.^.Richa.^.........PE..d...@.B.........."......`...`.......Q.........@.....................................\....`.......... ......................................8...h........................%......X....y..T...........................@p..@............q...............................text...lQ.......`.................. ..`.rdata...!...p...0...p..............@..@.data...............................@....pdata..............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\BdeHdCfg.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):151552
                                                                                                                                                                                                                                Entropy (8bit):6.43402000676882
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:Dc8nU8jHda2EKHVZzwnVS570M9kdatGCO+xmBc+hMPhPsx:gaHsKHVZ8Vs7nyatGt+SYF
                                                                                                                                                                                                                                MD5:75FF14F268F702BA3A4B587DA25FFBF7
                                                                                                                                                                                                                                SHA1:8B3DC5DD07892B4DCF89387CC63A80D13B426D8F
                                                                                                                                                                                                                                SHA-256:A801668846E136C71CE2D9DA4C2CF7DFAC7B9B85F2911983A3234CA6A305F0D0
                                                                                                                                                                                                                                SHA-512:669764878CB0D788A2B3261C6E2D5CE35B7E4DAA24426BB14F1B6D768C494BB0DBF335E84F6E7C4A82B97769F9C201DA4485301E7BB0F1769B3823664A099D9C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NI...I...I...@.*.[......J......]......J......B...I.........M.....F.H......H...RichI...........................PE..d...Q.{%.........."......@.....................@.............................P............`.......... ......................................xa..,...............<............@..8...DX..T...........................0P..@...........pQ..(............................text....<.......@.................. ..`.rdata...#...P...0...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..8....@.......@..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\CameraSettingsUIHost.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):59240
                                                                                                                                                                                                                                Entropy (8bit):4.658196711989183
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:X5zXaWb2HOq/hn2UCDKOAxT1PFUJu9zOR:XlKWb2uL3DKOATPgqz2
                                                                                                                                                                                                                                MD5:BEDDC70010AD9F0554F95863F057FAB8
                                                                                                                                                                                                                                SHA1:69F01FE5DF20A5B8CB3E491E71DBB6E8D71BC762
                                                                                                                                                                                                                                SHA-256:B6312CA0B4BBABF73C2FCC4B9CFD3E2D5F6ADB3135A44F708D0D62C26FFA6305
                                                                                                                                                                                                                                SHA-512:278EF6BD6CDB7CE8F425F0662C2B315792F64AB13E4225E4384742660C0246A758D53E549830841492BEE63E4651D61FBA3B6ABA67A21D387CAB5BBBF21E9FCA
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.6...X...X...X......X.D.[...X.D.]...X.D.Y...X...Y.g.X.D.P...X.D.\...X.D.....X.D.....X.D.Z...X.Rich..X.........................PE..d.....#l.........."......@...p.................@....................................5................ .......................................u..................8.......h'..........hj..T............................b..@............c..0............................text....7.......@.................. ..`.imrsiv......P...........................rdata..."...`...0...P..............@..@.data... ...........................@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6897664
                                                                                                                                                                                                                                Entropy (8bit):7.785814923953667
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:196608:6wMRnfQnKqR2igJDe4Fy5nuZqNqwec+N27EowvmV8:6wMVqDAdI5tvecK6EHvmV
                                                                                                                                                                                                                                MD5:F8EFB05B940B05FC74801B61B3C0F500
                                                                                                                                                                                                                                SHA1:8E3EB6D604F3552D48EBCB385FC2681716B172AF
                                                                                                                                                                                                                                SHA-256:90C6B16DE088AB3F5737BCB599BB9FFD69A28ABD149AB986B7FE52BA8BB2F400
                                                                                                                                                                                                                                SHA-512:028EA55F06FBFB079673DF19E6E6249E3A2107A3D5485586F8C18724BF0A6A996EA5A7E31721BED9F7BF677BBF789C596994601076C66676C92FBD3A94741FFF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 34%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(.`F..`F..`F..2...`F..2...`F..2..z`F.c....`F..`G..`F......`F......`F......`F.Rich.`F.........................PE..L...mx.`.................Z..........&........p....@..........................0......{.i...@....................................x.... ..B......................./..................................P.h.@...........................................text....Y.......Z.................. ..`.data....T...p...._..^..............@....idata...............h.............@..@.debug...............h.............@....reloc.../......0....i.............@..B.rsrc...B.... .......4i.............@..@................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\atieclxx.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):769048
                                                                                                                                                                                                                                Entropy (8bit):6.569037335109357
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:QqOWGb4aNztrzzKhN3xGow9nxxArbKijcmo:JGb4aNzFKPw9nwqigmo
                                                                                                                                                                                                                                MD5:AA946F9858F8AB75313C108A06C77A06
                                                                                                                                                                                                                                SHA1:15A5600460F4AD9AB9FF001D6A2192AA4737816B
                                                                                                                                                                                                                                SHA-256:03E773E99BABB51FF63393606304CBCC42AFE64EEEEA40D399D396AB0270DD2D
                                                                                                                                                                                                                                SHA-512:C21220157F60287F7D995BC97BF1572B0351EC77E87430B329E053077FB95F7AE09F982F4B56C7C14599B0848B568E5590952B2379CF91F96B26B4441A98FAA7
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................W............................................U...............[.........Rich...........PE..d.....=_.........."......(..........<M.........@..........................................`.....................................................h....`...........v...4.......p..........T........................... ................@..@............................text....'.......(.................. ..`.rdata...l...@...n...,..............@..@.data....+..........................@....pdata...v.......x..................@..@.rsrc........`......."..............@..@.reloc.......p.......*..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\change.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36864
                                                                                                                                                                                                                                Entropy (8bit):2.8922904731161987
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:1po1Z5lJovKluEr3PWJgH4vgz6DH6Kq+FT/EeKHW+LW:1qpovIb3xH4gzgHjtsth
                                                                                                                                                                                                                                MD5:9474A545BD1A6CC66A3DD0DD58AB9900
                                                                                                                                                                                                                                SHA1:BA7814B8CE8122C14BA7DBA6218AE836DE0DC116
                                                                                                                                                                                                                                SHA-256:9CCCAC53362E13EDCD64BED66ABE570606A9F4921B39621332764B48D0817F2F
                                                                                                                                                                                                                                SHA-512:481E126BE52BBC7F3616CD04C1ED6C077B1BC71C00F6D16D1A462BF43E2924E237A0427BC73A9927F326EDC9C76E0F8FA3CBB5E37FFC8765B54C0BB17B9DD2B8
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:#..Tp..Tp..Tp.Qq..Tp.Wq..Tp.Pq..Tp.Uq..Tp..Up..Tp.\q..Tp.p..Tp.Vq..TpRich..Tp................PE..d....u............"...... ...p...... ..........@.....................................U....`.......... ......................................0=..d.......0....p..t...............0....7..T............................0..@...........P1..(............................text...p........ .................. ..`.rdata..$....0... ...0..............@..@.data........P.......P..............@....pdata..t....p.......`..............@..@.rsrc...0............p..............@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\changepk.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):125376
                                                                                                                                                                                                                                Entropy (8bit):5.039541687586698
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:EHpRtYQtqw51JepgpuZ7gkT5vzj07j5UfUF2Pmz1:2pPt9Lepdxg8lK5UfUF2ux
                                                                                                                                                                                                                                MD5:EE0F08F2B1799960786EFC38F1D212D5
                                                                                                                                                                                                                                SHA1:C6708B30C974CD326EA540415BAE0666D6A0780A
                                                                                                                                                                                                                                SHA-256:C6929B7DD7EAD3BDDB12F3FB953602464C426425A354CE7AB0B77CC53F696A36
                                                                                                                                                                                                                                SHA-512:8CC5ACA4DB093884A47D31243F1278C0E2360BED6B6CBEC6D7DD7AC1170F05F3BD0493A04EF59CD93FB16836B4785F9FFA0E7EBDD45B085244C58FE1FBBCCA67
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............G...G...G...G...G..F...G..F...G..F...G...G...G..F...G..F...G..G...G..G...G..F...GRich...G................PE..d...MX............"......`...P.......[.........@..................................................... ......................................@...@........................)......L...H...T...............................@...........P................................text....Z.......`.................. ..`.imrsiv......p...........................rdata...!.......0...p..............@..@.data... ...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\tQYsPom.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):6897664
                                                                                                                                                                                                                                Entropy (8bit):7.785814923953667
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:196608:6wMRnfQnKqR2igJDe4Fy5nuZqNqwec+N27EowvmV8:6wMVqDAdI5tvecK6EHvmV
                                                                                                                                                                                                                                MD5:F8EFB05B940B05FC74801B61B3C0F500
                                                                                                                                                                                                                                SHA1:8E3EB6D604F3552D48EBCB385FC2681716B172AF
                                                                                                                                                                                                                                SHA-256:90C6B16DE088AB3F5737BCB599BB9FFD69A28ABD149AB986B7FE52BA8BB2F400
                                                                                                                                                                                                                                SHA-512:028EA55F06FBFB079673DF19E6E6249E3A2107A3D5485586F8C18724BF0A6A996EA5A7E31721BED9F7BF677BBF789C596994601076C66676C92FBD3A94741FFF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 34%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(.`F..`F..`F..2...`F..2...`F..2..z`F.c....`F..`G..`F......`F......`F......`F.Rich.`F.........................PE..L...mx.`.................Z..........&........p....@..........................0......{.i...@....................................x.... ..B......................./..................................P.h.@...........................................text....Y.......Z.................. ..`.data....T...p...._..^..............@....idata...............h.............@..@.debug...............h.............@....reloc.../......0....i.............@..B.rsrc...B.... .......4i.............@..@................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\DEC.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):99840
                                                                                                                                                                                                                                Entropy (8bit):7.932118007798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:UuA4VHs2nWTdJ2bWK4GczEfaMbDIQ7i4gaIEX+xGllnWfRrxstfcBDAoef8bCDm:G72A2f8zEf/IQetEXkGlJMccB5jb+m
                                                                                                                                                                                                                                MD5:F1768F17E3009C4232A2C1F616A6954E
                                                                                                                                                                                                                                SHA1:C690509EF61C0B88B043CF9828D2C76C5F1807C4
                                                                                                                                                                                                                                SHA-256:2CE28F3CE128598F7D67B0266E4374120CD27BE7DDD642DBC364844F7196F8AE
                                                                                                                                                                                                                                SHA-512:A687DD14EFDC1D2FEB7858602F0423423A524DFDDFF29FDE0B965E75C8905DC3D3FC7BC8F9D72380890042EE5B1AF2A44F98487927261F760E95C793D9FFFC01
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 96%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............."...0..|...........5... ........@.. ....................................`..................................4..O...................................D4..8............................................ ............... ..H............text....{... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B.................4......H........$..T..............................................................]*....0............i.s........+...o.......X.... ....2..o........(...+....8.........-N....d....(......(....&s..........o.........o...........o....r...p(.....3....+.s....%.o....%.o....%.o....%.o....%.o....%.o....%.Lo....%.o....%.o....%.o....%o.....Yo.........+........(...........o....+....2...X.. ....?........+<. ....... ...............XX.. ....].......................X.. ....2........8.......+w..X ....]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):760320
                                                                                                                                                                                                                                Entropy (8bit):6.561572491684602
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
                                                                                                                                                                                                                                MD5:544CD51A596619B78E9B54B70088307D
                                                                                                                                                                                                                                SHA1:4769DDD2DBC1DC44B758964ED0BD231B85880B65
                                                                                                                                                                                                                                SHA-256:DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
                                                                                                                                                                                                                                SHA-512:F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\TaFd.XRA

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2048000
                                                                                                                                                                                                                                Entropy (8bit):7.881673207108481
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:VQ/MiuIeQhJC6qtUyo/ghuXHzIXGO99rO093/GyIGgRaVrnLJ:h+h1yoYwI2O99r/LsRap
                                                                                                                                                                                                                                MD5:AD8CD38CC7E369CFE856E4F7A0A68F30
                                                                                                                                                                                                                                SHA1:9AE8EE2B0A2E2468E234C092EBB3087184A9F7C4
                                                                                                                                                                                                                                SHA-256:27A73216E76DEDE729F944997747921D9D338809EECC1E088664F3C1FFCCB8DD
                                                                                                                                                                                                                                SHA-512:AE5FE729C48AF136F1633EEF26594B5168C5933B17AEE837911DC21FAEC4F1073C7B6BECDF197125A6036880A5A99B46E28258B763A79E1ADF2728EA54933963
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@........................................-...L.F.L.F.L.F.5dF,L.F...G.L.F.LF.L.F..eF.L.FR.KF.M.F.4.F\M.F..IFNM.F.L.FjM.F..^F.L.F..NF.M.F.;XF)M.F...FeL.F^..G[L.F#(zF.M.F.:.F.M.F...F.L.F^..G.L.F^..G.M.F..YF.M.FR.LF.L.F.:.F.L.F.4.F\L.F..HF.M.F.;ZF.M.F.4.FmM.F..zFrM.F.5YF.M.F#(.G.L.F...G.M.Fk.OF L.FRich.L.F........................................................................................PE..L.....!f...........!.....0...L...F..@........................................P......*. .............................XH......|F..<........A...................`.......................................................@..D............................text...P'.......0.................. ..`.rdata.......@.......@..............@..@.data........P.......P...................qdata..d .......0..................@...Zz=..........@.......0..............@...rtJ4......... ......................@...9xTY8C...F.......P..................@...T............`... ...P..............@...aD......6r......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Tmp2BCA.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2662
                                                                                                                                                                                                                                Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                                MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                                SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                                SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                                SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Tmp2BDA.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2662
                                                                                                                                                                                                                                Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                                MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                                SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                                SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                                SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\MSVCP140.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):578384
                                                                                                                                                                                                                                Entropy (8bit):6.524580849411757
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
                                                                                                                                                                                                                                MD5:1BA6D1CF0508775096F9E121A24E5863
                                                                                                                                                                                                                                SHA1:DF552810D779476610DA3C8B956CC921ED6C91AE
                                                                                                                                                                                                                                SHA-256:74892D9B4028C05DEBAF0B9B5D9DC6D22F7956FA7D7EEE00C681318C26792823
                                                                                                                                                                                                                                SHA-512:9887D9F5838AA1555EA87968E014EDFE2F7747F138F1B551D1F609BC1D5D8214A5FDAB0D76FCAC98864C1DA5EB81405CA373B2A30CB12203C011D89EA6D069AF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f..f..f.....d..o.A.p..f........c.....n.....b...........g....-.g.....g..Richf..........................PE..d................." ...$.F...V......`1....................................................`A........................................PB..h.......,................9......PO......8...p...p...........................0...@............`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....8...@......................@....pdata...9.......:...<..............@..@.rsrc................v..............@..@.reloc..8............z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5653424
                                                                                                                                                                                                                                Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):290304
                                                                                                                                                                                                                                Entropy (8bit):7.872892408480815
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:CQrI4a86uBgv9Y6z8fd8SFzaYiYAJn9Q0B5e4zEONlM+chlkCb8JrRikP9:CQLXfEgdmBjn9X3EONS/YCq1P
                                                                                                                                                                                                                                MD5:376C58A0C1A4B549AA7E05759AB1B16E
                                                                                                                                                                                                                                SHA1:732C31C2A945704ADE1D4D718D11FAC49D0B3CC6
                                                                                                                                                                                                                                SHA-256:E7443391287D86FB914613FF642F45AD3A106A967C3C26FF8F0AF1B117E13EFB
                                                                                                                                                                                                                                SHA-512:795CCFC345EC6D09E43E831CC58ED382BFB3C3688C086E2BAD49434484C9937D25EA51BF1FF137F50FE6C6B7B9E5364282ECCFF07E3A25C472FF23EDD7779D6D
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|.F..r...r...r..e....r."hs...r..{s...r..vs...r..hv...r..hq...r..hw...r...s...r..hs...r."h{...r."hr...r."h....r."hp...r.Rich..r.........................PE..d......d.........." ................0........................................`............`..............................................T..4...........48... ...............P.. ...........................P...(.......8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96120
                                                                                                                                                                                                                                Entropy (8bit):6.440691568981583
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
                                                                                                                                                                                                                                MD5:4A365FFDBDE27954E768358F4A4CE82E
                                                                                                                                                                                                                                SHA1:A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
                                                                                                                                                                                                                                SHA-256:6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
                                                                                                                                                                                                                                SHA-512:54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36728
                                                                                                                                                                                                                                Entropy (8bit):6.340048377061949
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
                                                                                                                                                                                                                                MD5:9CFF894542DC399E0A46DEE017331EDF
                                                                                                                                                                                                                                SHA1:D1E889D22A5311BD518517537CA98B3520FC99FF
                                                                                                                                                                                                                                SHA-256:B1D3B6B3CDEB5B7B8187767CD86100B76233E7BBB9ACF56C64F8288F34B269CA
                                                                                                                                                                                                                                SHA-512:CA254231F12BDFC300712A37D31777FF9D3AA990CCC129129FA724B034F3B59C88ED5006A5F057348FA09A7DE4A0C2E0FB479CE06556E2059F919DDD037F239E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d....R^`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..x#......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_bz2.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):47792
                                                                                                                                                                                                                                Entropy (8bit):7.759135237425322
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:fSt1pAaIL2thxk3rjQgofeVaIqCGoDFQ7yqnuIJ7TpcgIIMVGpDG4yAehFj:C1pAaIaes3feV1iizgIIMVGry7
                                                                                                                                                                                                                                MD5:5F464B4F06DFE3AB504169FFDC7F53AE
                                                                                                                                                                                                                                SHA1:2942CF1F492213842D7BB8E8198355D3607B2F3B
                                                                                                                                                                                                                                SHA-256:0DD68268A9D47CE935FF932C3FE281E7A6D57E9CD424299D05560E56A773EF4B
                                                                                                                                                                                                                                SHA-512:D66C3C238A1EBDFB6F81436F8D0481F3ED8A0FF1212E3EFE466D6820E36DB50C31DCDB1019E46DCEDB753149A6CEF3F9485FC232F3DD42B96B7B0604DBAD6040
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..>...m...m...m...m...ms..l...my.bm...ms..l...ms..l...ms..l...m..l...mD..l...m...m~..m..l...m..l...m.`m...m..l...mRich...m........................PE..d.....`.........." ..................... ................................................`.........................................`...H......|............P..4.......................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_ctypes.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):58032
                                                                                                                                                                                                                                Entropy (8bit):7.837553293459017
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:GCwIk2ERK2HZqd6d93oXrCedXfxsYazzIIBPt0yzl:GHTPok3oXr5dvxsYafIIBPtbl
                                                                                                                                                                                                                                MD5:332D773008E12399AB98D085CD60C583
                                                                                                                                                                                                                                SHA1:C3AA78E9BA7732B989A3CAB996E63791EAF46A7F
                                                                                                                                                                                                                                SHA-256:19B813BCD356F37E73FE7D367051EB0BD901F2BD14CA8AD4662B1503B1459CEA
                                                                                                                                                                                                                                SHA-512:381C2083CCFDB39F3986060B21FF168EE87CFAFC4AD53B34DE3AE473A4FC0204615AF87E9EE69407D07528064C7B2A7D9F23A94939DE0E26C614169B8CC418AA
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t....x...x...x..m...x..ay...x..a}...x..a|...x..a{...x..ay...x..}|...x..}y...x.@|y...x...y.?.x..au...x..ax...x..a....x..az...x.Rich..x.................PE..d...|.`.........." ................ F.......................................p............`..........................................l.......i.......`.......................m......................................0R..8...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_elementtree.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):78512
                                                                                                                                                                                                                                Entropy (8bit):7.903168272994478
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:Ss4deEa1XFe+dq9uHZH6FMpNCL51ngCDVWNSIIkftTy5:wdrAZdj5aOpNCrnBWoIIkfto
                                                                                                                                                                                                                                MD5:5F8A8DA577CE431C77F5D4B8F972E5E0
                                                                                                                                                                                                                                SHA1:23306304175383DE4C6E039C9A106000BB28DA31
                                                                                                                                                                                                                                SHA-256:5A32E12FDE1F4E8A805D598E6CFBEC1E4AEAA9F9C1744BC3B1BF8B2AB9706686
                                                                                                                                                                                                                                SHA-512:1438C0DD7881CA76CCBCEAB054413C3E08EA373ECF6A109C9C1F4896585B5F12B0FBC9E954EB5DBAABDED498DF713FE96555A8ED861707982DC46D603363F939
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aG.M%&..%&..%&..,^d.)&..IR..'&..IR...&..IR..-&..IR..&&...R..'&..~N..&&..%&...&...R..!&...R..$&...R..$&...R..$&..Rich%&..................PE..d...n.`.........." .........................................................0............`..........................................,..X....)....... ..........x...........(-..........................................8...........................................UPX0....................................UPX1................................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_hashlib.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):28336
                                                                                                                                                                                                                                Entropy (8bit):7.503409203437653
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:EpNTVr+yTLZuSNa0x/iwRvz4SQ1ilQYHTMN6RoZa7gJX78IIYILyDG4y8XRShMpp:EpN7/dKwCSQoMppr8IIYILyDG4ybhMD
                                                                                                                                                                                                                                MD5:7A323C4FCE36AB53DA167E4074A68A77
                                                                                                                                                                                                                                SHA1:78A0E1EBBC7B357DBD37FCEE32589C4D0DC94DFE
                                                                                                                                                                                                                                SHA-256:07419B0862EDABE485317C199EE61B4DE838EC730789B12B8D660B6A1E5AAF76
                                                                                                                                                                                                                                SHA-512:8DAD82FA63917FF035271E8ED73C9F2ECDF5414E98D48A144F302C68CB16EA6D8DACF4FBFE11458B5D78715089EBAA45CD157AD53FB7989FD2FA81AFCE39E49A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^..^..^..&e.^...*..^...*..^...*..^...*..^..U*..^...6..^..)7..^..^...^..U*..^..U*..^..U*..^..U*..^..Rich.^..........................PE..d.....`.........." .....@................................................................`.............................................P...............................................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_lzma.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):86704
                                                                                                                                                                                                                                Entropy (8bit):7.922392665313969
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:r1mzwAeL7Ij2wtqklnNNxP/SxbtYOndQqUAVGd+fP3S+9kAUmIID1tmyPx:Io3wDNNxP/6btYUUEGd+HTPVIID1tNx
                                                                                                                                                                                                                                MD5:6CF80DCA091DAD17790A6B1AF4E85381
                                                                                                                                                                                                                                SHA1:BCB4052A4F960B429EB9DB019734FC00B41C4427
                                                                                                                                                                                                                                SHA-256:2B41390D1BFFA9C5B7018BC0544B0A2C188ECB9B00EBC56DF5A864DC47E32697
                                                                                                                                                                                                                                SHA-512:DA00F86C7A4168FA46FAEC79605831D26E4C86DD1D009B89F5087AC756BDFC32E0C036471639131EB881BCC53B8F1F92D947F3EF47F3DC7E56BB2E99D1357CF3
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.C.0.C.0.C.HOC.0.C.D.B.0.C.D.B.0.C.D.B.0.C.D.B.0.C>D.B.0.C.X.B.0.C.0.C.0.C>D.B.0.C>D.B.0.C>D#C.0.C>D.B.0.CRich.0.C........................PE..d.....`.........." .....0.......... .....................................................`.........................................|...L....................`...................................................... ...8...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_queue.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22704
                                                                                                                                                                                                                                Entropy (8bit):7.303940313534979
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:LubMpgolBKHStjxZHfdqWQ6Za7gJXW5IImUbMvkDG4y8e8C97hP:wM5Bzjj/dp9pm5IImUbMsDG4yaC97hP
                                                                                                                                                                                                                                MD5:7A9EAB9B45B38B485AD540FCD60FD1C2
                                                                                                                                                                                                                                SHA1:8FC5679207187B8E37F73C3826A0F1CEF06BC7D9
                                                                                                                                                                                                                                SHA-256:3E97629DB46D159DB614A2AF447A8FCD3CDEA807D7BDB8B32ADADB372B8ED3AE
                                                                                                                                                                                                                                SHA-512:1FA6745B5B9444D9AFEE8E8852B8BAF6790C40D6AF9C8ACE0AA5B5A242C1825CF7EEE467515270C55833D11878B1D6E36E67AAD3090A2BD7D504F8CC75D3E81D
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%a.ZD..ZD..ZD..S<..XD..60..XD..60..QD..60..RD..60..YD..0..YD...,..XD..ZD...D..0..[D..0..[D..0..[D..0..[D..RichZD..........PE..d...o.`.........." .....0.......... .....................................................`.........................................8...L.......P............`..0................................................... ...8...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_socket.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):41136
                                                                                                                                                                                                                                Entropy (8bit):7.669436133022269
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:Y2N9l9nLOO9DF7h5c5pZEVLxWQ+rHqKw1pAT9IIBwmS3F94DG4ytU9h/:PNZnv9c5p40KgT9IIBwmA4yin
                                                                                                                                                                                                                                MD5:15A40AFE3A6A996DA1ED9C9EB13362B8
                                                                                                                                                                                                                                SHA1:FB7A8827FD244642A1BDA9E863E8A1137A791554
                                                                                                                                                                                                                                SHA-256:55C9F10D31037738DA2110BB88074CF4B6D65E256C9411560000330ED27704C1
                                                                                                                                                                                                                                SHA-512:F75213237180FE0395908F5E272217F8287A19083A00D23C5934061F27E07E00B5130CCD44453C2633B2406433D3E537F45923E4712EF420BB60CC9307030990
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<...=...<...9...<...8...<...?...<.'.=...<...=...<...=.I.<.'.1...<.'.<...<.'....<.'.>...<.Rich..<.................PE..d.....`.........." .................r....................................................`............................................P...................0..8...........@... ....................................~..8...........................................UPX0....................................UPX1.............r..................@....rsrc................v..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\_ssl.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):59056
                                                                                                                                                                                                                                Entropy (8bit):7.8302873217993465
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:kMAft6h1P/xN70ArkFOwFU3Q6ji9OaIIM7dU40y8j:kM0t81BhrkQwU3g9vIIM7dc
                                                                                                                                                                                                                                MD5:A61613B2A31FB6C1D0F11A2AB42C3A9E
                                                                                                                                                                                                                                SHA1:A51069C3AEB3C7C8D802CF076005B1C1717CA12A
                                                                                                                                                                                                                                SHA-256:1B39EAC9D666211E670E37420D9FD43516695E7EF53832F4DBD86B6E97FC9BF3
                                                                                                                                                                                                                                SHA-512:A35283C7FB47E79580917252CB08329C5F302A77322FFD8A0FE5CD8C081130C5FA28C5E7EB3D7EB8C6D0DCA25A7D423CB303AB2EC82296EAC41C91E38369CCAF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4b{.p...p...p...y{..v....w..r....w..|....w..x....w..s....w..r....j..t...+k..w...p........w..r....w..q....w.q....w..q...Richp...........PE..d.....`.........." ......................................................................`.............................................d....................@..........................................................8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.608323768366966
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
                                                                                                                                                                                                                                MD5:07EBE4D5CEF3301CCF07430F4C3E32D8
                                                                                                                                                                                                                                SHA1:3B878B2B2720915773F16DBA6D493DAB0680AC5F
                                                                                                                                                                                                                                SHA-256:8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
                                                                                                                                                                                                                                SHA-512:6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11736
                                                                                                                                                                                                                                Entropy (8bit):6.6074868843808785
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
                                                                                                                                                                                                                                MD5:557405C47613DE66B111D0E2B01F2FDB
                                                                                                                                                                                                                                SHA1:DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
                                                                                                                                                                                                                                SHA-256:913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
                                                                                                                                                                                                                                SHA-512:C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.622854484071805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
                                                                                                                                                                                                                                MD5:624401F31A706B1AE2245EB19264DC7F
                                                                                                                                                                                                                                SHA1:8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
                                                                                                                                                                                                                                SHA-256:58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
                                                                                                                                                                                                                                SHA-512:3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.670771733256744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
                                                                                                                                                                                                                                MD5:2DB5666D3600A4ABCE86BE0099C6B881
                                                                                                                                                                                                                                SHA1:63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
                                                                                                                                                                                                                                SHA-256:46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
                                                                                                                                                                                                                                SHA-512:7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15328
                                                                                                                                                                                                                                Entropy (8bit):6.561472518225768
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
                                                                                                                                                                                                                                MD5:0F7D418C05128246AFA335A1FB400CB9
                                                                                                                                                                                                                                SHA1:F6313E371ED5A1DFFE35815CC5D25981184D0368
                                                                                                                                                                                                                                SHA-256:5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
                                                                                                                                                                                                                                SHA-512:7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.638884356866373
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
                                                                                                                                                                                                                                MD5:5A72A803DF2B425D5AAFF21F0F064011
                                                                                                                                                                                                                                SHA1:4B31963D981C07A7AB2A0D1A706067C539C55EC5
                                                                                                                                                                                                                                SHA-256:629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
                                                                                                                                                                                                                                SHA-512:BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11744
                                                                                                                                                                                                                                Entropy (8bit):6.744400973311854
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
                                                                                                                                                                                                                                MD5:721B60B85094851C06D572F0BD5D88CD
                                                                                                                                                                                                                                SHA1:4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
                                                                                                                                                                                                                                SHA-256:DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
                                                                                                                                                                                                                                SHA-512:430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11736
                                                                                                                                                                                                                                Entropy (8bit):6.638488013343178
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
                                                                                                                                                                                                                                MD5:D1DF480505F2D23C0B5C53DF2E0E2A1A
                                                                                                                                                                                                                                SHA1:207DB9568AFD273E864B05C87282987E7E81D0BA
                                                                                                                                                                                                                                SHA-256:0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
                                                                                                                                                                                                                                SHA-512:F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12256
                                                                                                                                                                                                                                Entropy (8bit):6.588267640761022
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
                                                                                                                                                                                                                                MD5:73433EBFC9A47ED16EA544DDD308EAF8
                                                                                                                                                                                                                                SHA1:AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
                                                                                                                                                                                                                                SHA-256:C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
                                                                                                                                                                                                                                SHA-512:1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.678828474114903
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
                                                                                                                                                                                                                                MD5:7C7B61FFA29209B13D2506418746780B
                                                                                                                                                                                                                                SHA1:08F3A819B5229734D98D58291BE4BFA0BEC8F761
                                                                                                                                                                                                                                SHA-256:C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
                                                                                                                                                                                                                                SHA-512:6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12752
                                                                                                                                                                                                                                Entropy (8bit):6.602852377056617
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
                                                                                                                                                                                                                                MD5:6D0550D3A64BD3FD1D1B739133EFB133
                                                                                                                                                                                                                                SHA1:C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
                                                                                                                                                                                                                                SHA-256:F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
                                                                                                                                                                                                                                SHA-512:5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14800
                                                                                                                                                                                                                                Entropy (8bit):6.528059454770997
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
                                                                                                                                                                                                                                MD5:1ED0B196AB58EDB58FCF84E1739C63CE
                                                                                                                                                                                                                                SHA1:AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
                                                                                                                                                                                                                                SHA-256:8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
                                                                                                                                                                                                                                SHA-512:E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.659218747104705
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
                                                                                                                                                                                                                                MD5:721BAEA26A27134792C5CCC613F212B2
                                                                                                                                                                                                                                SHA1:2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
                                                                                                                                                                                                                                SHA-256:5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
                                                                                                                                                                                                                                SHA-512:9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.739082809754283
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
                                                                                                                                                                                                                                MD5:B3F887142F40CB176B59E58458F8C46D
                                                                                                                                                                                                                                SHA1:A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
                                                                                                                                                                                                                                SHA-256:8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
                                                                                                                                                                                                                                SHA-512:7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12752
                                                                                                                                                                                                                                Entropy (8bit):6.601112204637961
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
                                                                                                                                                                                                                                MD5:89F35CB1212A1FD8FBE960795C92D6E8
                                                                                                                                                                                                                                SHA1:061AE273A75324885DD098EE1FF4246A97E1E60C
                                                                                                                                                                                                                                SHA-256:058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
                                                                                                                                                                                                                                SHA-512:F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14288
                                                                                                                                                                                                                                Entropy (8bit):6.521808801015781
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
                                                                                                                                                                                                                                MD5:0C933A4B3C2FCF1F805EDD849428C732
                                                                                                                                                                                                                                SHA1:B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
                                                                                                                                                                                                                                SHA-256:A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
                                                                                                                                                                                                                                SHA-512:B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.671157737548847
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
                                                                                                                                                                                                                                MD5:7E8B61D27A9D04E28D4DAE0BFA0902ED
                                                                                                                                                                                                                                SHA1:861A7B31022915F26FB49C79AC357C65782C9F4B
                                                                                                                                                                                                                                SHA-256:1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
                                                                                                                                                                                                                                SHA-512:1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.599056003106114
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
                                                                                                                                                                                                                                MD5:8D12FFD920314B71F2C32614CC124FEC
                                                                                                                                                                                                                                SHA1:251A98F2C75C2E25FFD0580F90657A3EA7895F30
                                                                                                                                                                                                                                SHA-256:E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
                                                                                                                                                                                                                                SHA-512:5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.602527553095181
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
                                                                                                                                                                                                                                MD5:9FA3FC24186D912B0694A572847D6D74
                                                                                                                                                                                                                                SHA1:93184E00CBDDACAB7F2AD78447D0EAC1B764114D
                                                                                                                                                                                                                                SHA-256:91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
                                                                                                                                                                                                                                SHA-512:95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.6806369134652055
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
                                                                                                                                                                                                                                MD5:C9CBAD5632D4D42A1BC25CCFA8833601
                                                                                                                                                                                                                                SHA1:09F37353A89F1BFE49F7508559DA2922B8EFEB05
                                                                                                                                                                                                                                SHA-256:F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
                                                                                                                                                                                                                                SHA-512:2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13776
                                                                                                                                                                                                                                Entropy (8bit):6.573983778839785
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
                                                                                                                                                                                                                                MD5:4CCDE2D1681217E282996E27F3D9ED2E
                                                                                                                                                                                                                                SHA1:8EDA134B0294ED35E4BBAC4911DA620301A3F34D
                                                                                                                                                                                                                                SHA-256:D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
                                                                                                                                                                                                                                SHA-512:93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.7137872023984055
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
                                                                                                                                                                                                                                MD5:E86CFC5E1147C25972A5EEFED7BE989F
                                                                                                                                                                                                                                SHA1:0075091C0B1F2809393C5B8B5921586BDD389B29
                                                                                                                                                                                                                                SHA-256:72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
                                                                                                                                                                                                                                SHA-512:EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12768
                                                                                                                                                                                                                                Entropy (8bit):6.614330511483598
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
                                                                                                                                                                                                                                MD5:206ADCB409A1C9A026F7AFDFC2933202
                                                                                                                                                                                                                                SHA1:BB67E1232A536A4D1AE63370BD1A9B5431335E77
                                                                                                                                                                                                                                SHA-256:76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
                                                                                                                                                                                                                                SHA-512:727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.704366348384627
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
                                                                                                                                                                                                                                MD5:91A2AE3C4EB79CF748E15A58108409AD
                                                                                                                                                                                                                                SHA1:D402B9DF99723EA26A141BFC640D78EAF0B0111B
                                                                                                                                                                                                                                SHA-256:B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
                                                                                                                                                                                                                                SHA-512:8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11728
                                                                                                                                                                                                                                Entropy (8bit):6.623077637622405
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
                                                                                                                                                                                                                                MD5:1E4C4C8E643DE249401E954488744997
                                                                                                                                                                                                                                SHA1:DB1C4C0FC907100F204B21474E8CD2DB0135BC61
                                                                                                                                                                                                                                SHA-256:F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
                                                                                                                                                                                                                                SHA-512:EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12752
                                                                                                                                                                                                                                Entropy (8bit):6.643812426159955
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
                                                                                                                                                                                                                                MD5:FA770BCD70208A479BDE8086D02C22DA
                                                                                                                                                                                                                                SHA1:28EE5F3CE3732A55CA60AEE781212F117C6F3B26
                                                                                                                                                                                                                                SHA-256:E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
                                                                                                                                                                                                                                SHA-512:F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15824
                                                                                                                                                                                                                                Entropy (8bit):6.438848882089563
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
                                                                                                                                                                                                                                MD5:4EC4790281017E616AF632DA1DC624E1
                                                                                                                                                                                                                                SHA1:342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
                                                                                                                                                                                                                                SHA-256:5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
                                                                                                                                                                                                                                SHA-512:80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.6061629057490245
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
                                                                                                                                                                                                                                MD5:7A859E91FDCF78A584AC93AA85371BC9
                                                                                                                                                                                                                                SHA1:1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
                                                                                                                                                                                                                                SHA-256:B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
                                                                                                                                                                                                                                SHA-512:A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13776
                                                                                                                                                                                                                                Entropy (8bit):6.65347762698107
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
                                                                                                                                                                                                                                MD5:972544ADE7E32BFDEB28B39BC734CDEE
                                                                                                                                                                                                                                SHA1:87816F4AFABBDEC0EC2CFEB417748398505C5AA9
                                                                                                                                                                                                                                SHA-256:7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
                                                                                                                                                                                                                                SHA-512:5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12752
                                                                                                                                                                                                                                Entropy (8bit):6.58394079658593
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
                                                                                                                                                                                                                                MD5:8906279245F7385B189A6B0B67DF2D7C
                                                                                                                                                                                                                                SHA1:FCF03D9043A2DAAFE8E28DEE0B130513677227E4
                                                                                                                                                                                                                                SHA-256:F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
                                                                                                                                                                                                                                SHA-512:67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.696904963591775
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
                                                                                                                                                                                                                                MD5:DD8176E132EEDEA3322443046AC35CA2
                                                                                                                                                                                                                                SHA1:D13587C7CC52B2C6FBCAA548C8ED2C771A260769
                                                                                                                                                                                                                                SHA-256:2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
                                                                                                                                                                                                                                SHA-512:77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20944
                                                                                                                                                                                                                                Entropy (8bit):6.216554714002396
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
                                                                                                                                                                                                                                MD5:A6A3D6D11D623E16866F38185853FACD
                                                                                                                                                                                                                                SHA1:FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
                                                                                                                                                                                                                                SHA-256:A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
                                                                                                                                                                                                                                SHA-512:ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19920
                                                                                                                                                                                                                                Entropy (8bit):6.194200929301547
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
                                                                                                                                                                                                                                MD5:B5C8AF5BADCDEFD8812AF4F63364FE2B
                                                                                                                                                                                                                                SHA1:750678935010A83E2D83769445F0D249E4568A8D
                                                                                                                                                                                                                                SHA-256:7101B3DFF525EA47B7A40DD96544C944AE400447DF7A6ACD07363B6D7968B889
                                                                                                                                                                                                                                SHA-512:A2A8D08D658F5ED368F9FB556BFB13B897F31E9540BFDFFF6567826614D6C5F0D64BD08FEC66C63E74D852AB6B083294E187507E83F2BC284DFB7CA5C86AE047
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......:.........." .........(...............................................P......uM....`A........................................P.... ...........@...............,...!..............p............................................................................rdata..D".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12752
                                                                                                                                                                                                                                Entropy (8bit):6.604643094751227
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
                                                                                                                                                                                                                                MD5:074B81A625FB68159431BB556D28FAB5
                                                                                                                                                                                                                                SHA1:20F8EAD66D548CFA861BC366BB1250CED165BE24
                                                                                                                                                                                                                                SHA-256:3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
                                                                                                                                                                                                                                SHA-512:36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16336
                                                                                                                                                                                                                                Entropy (8bit):6.449023660091811
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
                                                                                                                                                                                                                                MD5:F1A23C251FCBB7041496352EC9BCFFBE
                                                                                                                                                                                                                                SHA1:BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
                                                                                                                                                                                                                                SHA-256:D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
                                                                                                                                                                                                                                SHA-512:31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):17872
                                                                                                                                                                                                                                Entropy (8bit):6.3934828478655685
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
                                                                                                                                                                                                                                MD5:55B2EB7F17F82B2096E94BCA9D2DB901
                                                                                                                                                                                                                                SHA1:44D85F1B1134EE7A609165E9C142188C0F0B17E0
                                                                                                                                                                                                                                SHA-256:F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
                                                                                                                                                                                                                                SHA-512:0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):18384
                                                                                                                                                                                                                                Entropy (8bit):6.279474608881223
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
                                                                                                                                                                                                                                MD5:9B79965F06FD756A5EFDE11E8D373108
                                                                                                                                                                                                                                SHA1:3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
                                                                                                                                                                                                                                SHA-256:1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
                                                                                                                                                                                                                                SHA-512:7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14288
                                                                                                                                                                                                                                Entropy (8bit):6.547753630184197
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
                                                                                                                                                                                                                                MD5:1D48A3189A55B632798F0E859628B0FB
                                                                                                                                                                                                                                SHA1:61569A8E4F37ADC353986D83EFC90DC043CDC673
                                                                                                                                                                                                                                SHA-256:B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
                                                                                                                                                                                                                                SHA-512:47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12240
                                                                                                                                                                                                                                Entropy (8bit):6.686357863452704
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
                                                                                                                                                                                                                                MD5:DBC27D384679916BA76316FB5E972EA6
                                                                                                                                                                                                                                SHA1:FB9F021F2220C852F6FF4EA94E8577368F0616A4
                                                                                                                                                                                                                                SHA-256:DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
                                                                                                                                                                                                                                SHA-512:CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\base_library.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1032264
                                                                                                                                                                                                                                Entropy (8bit):5.502997687157409
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:fhidCutosQNRs54PK4IMpVw597fCEb3avESWGR326V:fhidCutosQNRs54PK4Ir9avjWMHV
                                                                                                                                                                                                                                MD5:8A2AF800E6C75ABE6D2FA4060655DD50
                                                                                                                                                                                                                                SHA1:68B5B5B2F9BC3A951B47841957C03923C47D5C12
                                                                                                                                                                                                                                SHA-256:E5D9CE91DAF8D8330E34D1E3856BD2B481EF55F374EB3836A429125E1F8E51C0
                                                                                                                                                                                                                                SHA-512:913F829A36370F949BA055303E270A414646CE7D269B7E0FD6EB91D82B9CA5E337CE6714404386A48BB22C84034B9F92823DFA6CF104662D56FDFA27B28CD27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.|...|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...|.r.t...t.j.j.r.d.S.t...t.j...}.|.s2t.j.d.k.r2d.}.|.S.).Nr......darwin....A

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\certifi\cacert.pem

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):281617
                                                                                                                                                                                                                                Entropy (8bit):6.048201407322743
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
                                                                                                                                                                                                                                MD5:78D9DD608305A97773574D1C0FB10B61
                                                                                                                                                                                                                                SHA1:9E177F31A3622AD71C3D403422C9A980E563FE32
                                                                                                                                                                                                                                SHA-256:794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
                                                                                                                                                                                                                                SHA-512:0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md.cp38-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9728
                                                                                                                                                                                                                                Entropy (8bit):6.599679776617318
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:Id0Mp/QthczuG47NfGTJiWpjy9h+laGgazukYBbPJBj34lVhXg246ae7sXtpHqrY:It6tq4hfGNp2azdzukYj273QJXpHIH
                                                                                                                                                                                                                                MD5:3EC61DACFBE1E165DE5FE35FB92FA6D4
                                                                                                                                                                                                                                SHA1:A7605431D0A9BABE59CDBD5D39C292D5AB8BBF43
                                                                                                                                                                                                                                SHA-256:3ACEA3CB557E4A7DF92FC34AD2CB1D654CF3C2254C00C690DA32C1A1F27BA4FA
                                                                                                                                                                                                                                SHA-512:8E1DD08528C3A04086C914094D3A21A78962249A65EE31A7A2AAE37D59A004E1586D16254DA8FACCBB9386025BE538041C968A1DC4AD90FD35921A12910DECFE
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B1...P...P...P...(...P.../...P..M(...P.../...P.../...P.../...P...$...P...P.. P..?...P..?...P..?.a..P..?...P..Rich.P..........................PE..d....gAe.........." ...%. .......p........................................................`.........................................@...l......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):39424
                                                                                                                                                                                                                                Entropy (8bit):7.8391240913672435
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:4ULF2V3+5GZkuG1xI0EcbOkA6BgKjxbcg3opQAsiMOvpBel:Tc3wGrc4FqgrLOAsiBel
                                                                                                                                                                                                                                MD5:599D207F2DEBB191A262B407C4CC72F4
                                                                                                                                                                                                                                SHA1:3BD74DA03C4FE18566E5AEF38B871FAC759FB2D8
                                                                                                                                                                                                                                SHA-256:004CF0FE91F3A5837CD7BABFE21F5C8461E7A181B7C94AEF92EEE7CF7B327FC8
                                                                                                                                                                                                                                SHA-512:6DB4B491E8AC9EBFF482A38FE2AB26592B1610D3A53DF9F630F604FE2EE8B8B7F8020D2BE9F37870F7E942A857B84E90FD7A3DB92E2F1119273DCC35CA21B9C6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............pr..pr..pr......pr...s..pr...s..pr...w..pr...v..pr...q..pr.#.s..pr..ps..pr...z..pr...r..pr......pr...p..pr.Rich.pr.........................PE..d....gAe.........." ...%.............3.......................................`............`..........................................R..`....P.......P......................8S.......................................?..@...........................................UPX0....................................UPX1................................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\exe\netconn_properties.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):61440
                                                                                                                                                                                                                                Entropy (8bit):7.921620889726641
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:HQDJbWAHTCQezq6UT9fLUwTEJ6hh9BUusFvQrnouy8:cJiES2RfYEhyusFvaout
                                                                                                                                                                                                                                MD5:3B8E84142573A5E30990BDE2E574C447
                                                                                                                                                                                                                                SHA1:C3EB3D19655F022B404E6F35764BBF80931FACB6
                                                                                                                                                                                                                                SHA-256:844BC565498F3C7B74E46770EDC35EB3A20F16F0EB619250C83E40ECA1C0F493
                                                                                                                                                                                                                                SHA-512:3AD2BE91CEDCC261227A496C51A39F69933B6396735E15E51458D48BD69F444201BA948A5E639345222B18981833F47F19538375DBE2C4C37014377B2031DA2D
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... 7..Nd..Nd..Nd..Me..Nd..Ke..Nd..Je..Nd..Me..Nd..Ke..Nd..Je..Nd..Oe..Nd..Od..Nd+.Ge..Nd+.d..Nd+.Le..NdRich..Nd........PE..L......d...............".........p...Z.......p....@.......................................@..................................q.......p.......................r.. ...................................|f..............................................UPX0.....p..............................UPX1................................@....rsrc........p......................@......................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\exe\registers.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11264
                                                                                                                                                                                                                                Entropy (8bit):6.941070129699565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:29c0mnxpjAz4YtdRinGDoPNm0aFFaNJhLkwcud2DH9VwGfct0nDs:cmnx+MYUnmoPHaTaNJawcudoD7Uws
                                                                                                                                                                                                                                MD5:527010682A02EE5935BAC5B2D074C49D
                                                                                                                                                                                                                                SHA1:868586F9C46F0BE6F33E732BFB25885608DD760F
                                                                                                                                                                                                                                SHA-256:6F5CF5FB3EC821E23D3B7039B45084FB746335E87609523E97559AA464CECFAA
                                                                                                                                                                                                                                SHA-512:F78983EC4168478730573C108A1F6463B0479A3C07091E66A07E84FD5641788434D6FCA8D9C659692337095FE55E3DFCF748F8712334832AA8B602EB68AFCB8C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.P...P...P...Y..\.....+.H.....*.\.....-.Q...../.U..../.R...P./.....F.'.Q...F...Q...F.,.Q...RichP...........................PE..L...6..e...............$.0.......p................@.......................................@.................................................................... ...................................|...............................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\exe\upx.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):537600
                                                                                                                                                                                                                                Entropy (8bit):7.929208677101443
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
                                                                                                                                                                                                                                MD5:8A98406E32ED6139BD9E75342D452948
                                                                                                                                                                                                                                SHA1:ED77737B88A7351D0BC5F542DDB7CE84F8F95588
                                                                                                                                                                                                                                SHA-256:A4240EA0E8A916D15F8391EDEF9705AB4DE1F516DD360F0A336C5358686D434B
                                                                                                                                                                                                                                SHA-512:F5B17975560D97308A6EE66845225715E82BADE9DF7BC36821C76FE67FCF8D22929BF21B85E28DD11B7399D0109AB1F3786FD2010C2E5023D3A93D2BD5CF678B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./......0..........@. .......@..............................0 ............... ..............................................% ...... ......P................................................ .(...................................................UPX0....................................UPX1.....0.......*..................@....rsrc........ ......,..............@...4.02.UPX!.$...............%...h..I.....m....D..f.....H..(H..58..1.......$.6.9..K..7.5f.8MZu.Hc...P<H..PE4tiR..._.........uF.i....d...B..6.y.7......`....o.,..1.8.tS1.L.(...~t@........P....wm..JE..u.........~...c...........#ha.............|..3.xtuD...wEzy7...f.^84%6L..w....^.......^....;..48..D$ R.....A.qt..8..AUATU....WVSH........lL...H..*..x=x6...........le&.%0...4..p.1.L.....%......H9...X......_.......H..3H..p5.g.};h.....Q#.2.........]..=8...Y,.Un...3..t.EX....?M..n.......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\libcrypto-1_1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1173184
                                                                                                                                                                                                                                Entropy (8bit):7.943479776599919
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:R+bGt1aXDUPxepW5HoZS4F4Z7KMUZVZ2OADo2ksJY1CPwDv3uFfJ:4KnYwwpsTOLnNt2kWY1CPwDv3uFfJ
                                                                                                                                                                                                                                MD5:EB33B1A0A12A1BFCB69FD2467F5C6B8C
                                                                                                                                                                                                                                SHA1:D30782A6BED3FD889846787D733D14519D757808
                                                                                                                                                                                                                                SHA-256:E631BFE0B26A864F61311A03BF1F0819ABDFFC7BC00D14D263714F934A085069
                                                                                                                                                                                                                                SHA-512:BEE2412914003AD4697D6A22CFE7550DE0E13C2A16DC5C8C1528CE361A84F987E8D43F58F0EABDACF6A09A01F7EDF04B310DCE41F02C4E809B04446D8DFF40E2
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<.<.<.5.;...n...>.n...7.n...4.n...?.g...7.<.......!.....E.....=...W.=.....=.Rich<.................PE..d....El`.........." ..............%...4.. %...................................6...........`......................................... .4.......4.h.....4.......1...............6.......................................4.............................................UPX0......%.............................UPX1......... %.....................@....rsrc.........4.....................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\libffi-7.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):24088
                                                                                                                                                                                                                                Entropy (8bit):7.527291720504194
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
                                                                                                                                                                                                                                MD5:6F818913FAFE8E4DF7FEDC46131F201F
                                                                                                                                                                                                                                SHA1:BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
                                                                                                                                                                                                                                SHA-256:3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
                                                                                                                                                                                                                                SHA-512:5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\libssl-1_1.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):202432
                                                                                                                                                                                                                                Entropy (8bit):7.916943155937212
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:2KEAslm/r4HLTmpLdH29Vam7bJnm8yPR:2U6+mTmpcram7NNy
                                                                                                                                                                                                                                MD5:88803AAC099CCCF4AF3496BFABDC8865
                                                                                                                                                                                                                                SHA1:3EEE4E685E0084F13935870BE3E2C7DDDB1975E4
                                                                                                                                                                                                                                SHA-256:C524B961D036C9E95AE4D9E40E8B4F897A4F0772CF1D78AC0287AF84FE918CAD
                                                                                                                                                                                                                                SHA-512:50BD41771E50E9C20AD871BE9433F6E88C3CD799A6F64D7AD19265228468A8572904EC2D9B3B8FF053B23230EC1326A175DF09CB0380E60D8EFDD11AB446F8FD
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...BkT.BkT.BkT.:.T.BkT.*jU.BkT.*jU.BkT.*nU.BkT.*oU.BkT.*hU.BkT(+jU.BkT.BjThCkT(+oU.BkT(+kU.BkT(+.T.BkT(+iU.BkTRich.BkT........................PE..d....El`.........." .........P...P..P....`...................................`............`.............................................4@.......................K...........V......................................P...............................................UPX0.....P..............................UPX1.........`......................@....rsrc....P.......H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):34816
                                                                                                                                                                                                                                Entropy (8bit):7.756084875002629
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:nrA/j6Vq1p3Kuu42ShVZmBKDRAdlq9gYe7JSp+AG:Wjz1p3dVZmBJQgpNA
                                                                                                                                                                                                                                MD5:FA4A63CC5BBC7B119DDEB9469B17A55D
                                                                                                                                                                                                                                SHA1:72EF6F8E5E7FE13EA64973E05DB297C8455754FB
                                                                                                                                                                                                                                SHA-256:EE2EACA1473E460BEFEBBC0149BA1A4537A9C9303C10AAA2FF6D8C8F74AC8BA3
                                                                                                                                                                                                                                SHA-512:77D0E34A46D0C05C9DE527283F726E6A7C96FE473D0C6A6F707EEA14F3BE4D1383BBD03B552C27455175ECC66CFF242177829154CA6EA4A12D704DE285693F41
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.][~.3.~.3.~.3.w...t.3.,.2.|.3.,.6.r.3.,.7.v.3.,.0.z.3...2.|.3.5.2.o.3.~.2...3...;.r.3...3...3.......3...1...3.Rich~.3.........PE..d.....ic.........." ............. .......0................................................`.........................................8...`......H............P..4......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\pyexpat.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):83120
                                                                                                                                                                                                                                Entropy (8bit):7.907238064399988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:Xp6V6J1lSnf2bGaeYiO3YM6gl7Sm24a1WUxCosj8dVu4pFUr9j2nNYsvkBExg9IE:oVY1InOb3ezY7Sm1a11xC/8SsMIIBh91
                                                                                                                                                                                                                                MD5:5F5C5041C392FA352223F248F056639F
                                                                                                                                                                                                                                SHA1:5FB30449F84653B3B26B1E2820577A67FD52AFB0
                                                                                                                                                                                                                                SHA-256:044751B6EB51B5D2E75394F7DA265747063101F2310E1D0AB6AB79DF7F589BE3
                                                                                                                                                                                                                                SHA-512:DE0F31D3B11DC45AB62EE0696B2031814A3D7F7DBAED98A27E87191850038A3930769B49826CB1D8E44D4F29A632EAB65277BB52156C917B599CC06E9F0B1718
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.;f..U5..U5..U5...5..U5s.T4..U5s.P4..U5s.Q4..U5s.V4..U5..T4..U5D.T4..U5..T5o.U5..X4..U5..U4..U5..5..U5..W4..U5Rich..U5........PE..d...u.`.........." ..... ..........p(... ...................................P............`.........................................tL..P....I.......@.......................L......................................p4..8...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\python3.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):59568
                                                                                                                                                                                                                                Entropy (8bit):5.881803359169673
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
                                                                                                                                                                                                                                MD5:C9F0B55FCE50C904DFF9276014CEF6D8
                                                                                                                                                                                                                                SHA1:9F9AE27DF619B695827A5AF29414B592FC584E43
                                                                                                                                                                                                                                SHA-256:074B06AE1D0A0B5C26F0CE097C91E2F24A5D38B279849115495FC40C6C10117E
                                                                                                                                                                                                                                SHA-512:8DD188003D8419A25DE7FBB37B29A4BC57A6FD93F2D79B5327AD2897D4AE626D7427F4E6AC84463C158BCB18B6C1E02E83ED49F347389252477BBEEB864AC799
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.0.l...d.0.d...d.0.....d.0.f...d.Rich..d.................PE..d...j.`.........." ......................................................................`.........................................` ..@............................................ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\python38.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1436848
                                                                                                                                                                                                                                Entropy (8bit):7.991911842353948
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:24576:4x/FMCGq6fqOD+5QKiQ6SqHPz5nTD8DRr7iNh+PyteisMfU5cSNdFHpFetZv710+:sSCYfqVmK56SK9TD80ptebRNXHpFeg+
                                                                                                                                                                                                                                MD5:7AB78070CA047F134156169C60CCA0A3
                                                                                                                                                                                                                                SHA1:F3FE769A202936D4C533A643F9A8B7CBDDA61CA4
                                                                                                                                                                                                                                SHA-256:C57BD27215609ECA66BEA7F88F4B5CE3BF39486DFDBAB7D5C684270507627D22
                                                                                                                                                                                                                                SHA-512:2F3CD43BEB3E0E1EA1581337289566159A707F3314852DC88C0353A65DD4A6D549AAC1EA66974893EC99A3C1E28B932D7D3AB9E612D102CB6211772F594181F1
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`....................................................................j...q...j.......j.....j.......Rich............................PE..d...a.`.........." .............`...\C..p...................................PD...........`.........................................8.C......yC.L....pC......p@..............AD......................................hC.8...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........pC.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pythoncom38.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):200192
                                                                                                                                                                                                                                Entropy (8bit):7.903772238406268
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:s7yyhL4NvlJyiWXG3OfJHe3ACEVXTCTWoKQnJhHkKwONMGsnG2bQUHJPpdir:sRhL4rsiWsWBibwevEKwO2GEGAtpd
                                                                                                                                                                                                                                MD5:E66C96A48F85B9F0B44D5006AEA7DAAC
                                                                                                                                                                                                                                SHA1:2E5ADB142EA5BB79DCDA2B72671B76855B85F633
                                                                                                                                                                                                                                SHA-256:EAEA8C3093EA2F566F7EF3F95CEF86E58FB9889E6D0423D6F0E182C86D6472FC
                                                                                                                                                                                                                                SHA-512:6659451D4495A8697A36205F80CF5174070BE354796B4618ED3C615D3335E4E4A5D47CFD1C4F8D3516A36FEAF8E81D5CB6F53006F2A3BEB2977D105C71975763
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+.P+...+...*...+...*...+...*...+...*...+...*...+..*...+..*...+..*...+...+...+...*...+...*...+...*...+Rich...+................PE..d...a..d.........." .........p... .......0...................................@............`......................................... ....c..`...........`........z...........:..........................................8...........................................UPX0..... ..............................UPX1.........0......................@....rsrc....p.......l..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\pywin32_system32\pywintypes38.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):64000
                                                                                                                                                                                                                                Entropy (8bit):7.595690275773314
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:48yGA8d6epdvLhWVhLAS1FjL9NxFRgCbTp4SZt8ei:9x7hYLAgFjLnxFV/p4le
                                                                                                                                                                                                                                MD5:C9B84B1AC14813C7C8FC5E7AB6EF788B
                                                                                                                                                                                                                                SHA1:C5EED330F129E5C6A9B817AD081CF8722E9EB147
                                                                                                                                                                                                                                SHA-256:F1D4431DA1300B9FE40DBE6C1E2C8311CD7F458EA1D8F2DB234137CF57C5D2D2
                                                                                                                                                                                                                                SHA-512:BD4B3AF8C9B87110197EA64572E97EA027EAD198EB24DE8EEE43BB70913E53BF96368FF2C1BF4D2BB5DB3EAB24DDB9F043760CF5A64EF6BBAF09DC63000ECA26
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .........P...........................................................`.........................................h...`B..h...........h....0.........................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\select.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):22192
                                                                                                                                                                                                                                Entropy (8bit):7.347287608561872
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Q9Pj6VLmXzJIGHkjCc4PevAZa7gJXdMrIImGbJ7EDG4y8iD0hS:1VSXzSIpNMrIImGbJYDG4y+hS
                                                                                                                                                                                                                                MD5:BFCE179B385145F6C0CB73AAC30318C1
                                                                                                                                                                                                                                SHA1:FF59AB14CBEB00A9C68369D998B101102673B6E2
                                                                                                                                                                                                                                SHA-256:04F0936EC038FF18927B5DEF896DB658B64F6DC9E6275E6AD03A7436D4F9A80A
                                                                                                                                                                                                                                SHA-512:A82ED3398C4F1C0D0AB8A5F5E75735D6D05D6F02C9B0A97EDB478482A0F3BEE0F49FEA35C5AFDFE373C33ADE510D0EBFF8DD02B0131D961BE7E5B5DDCBFDB88F
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.J.D.J.D.J.D.C...H.D.&.E.H.D.&.A.A.D.&.@.B.D.&.G.N.D...E.H.D...E.O.D.J.E.t.D...I.K.D...D.K.D....K.D...F.K.D.RichJ.D.........PE..d...o.`.........." .....0.......... .....................................................`.........................................d...L.......|............`......................................................0...8...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\ucrtbase.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1035728
                                                                                                                                                                                                                                Entropy (8bit):6.630126944065657
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
                                                                                                                                                                                                                                MD5:849959A003FA63C5A42AE87929FCD18B
                                                                                                                                                                                                                                SHA1:D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
                                                                                                                                                                                                                                SHA-256:6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
                                                                                                                                                                                                                                SHA-512:64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\unicodedata.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):287408
                                                                                                                                                                                                                                Entropy (8bit):7.985748275421679
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:GftoxCDFCv7FooOAr+MLDhGX2TUY2E/xFb30whI1o/yOp8wH2UN8u6ih6:CDDovNrRGGTvF5FZhI1o/yS88Ndh6
                                                                                                                                                                                                                                MD5:F9486E61971743562E9CDFAC3B26B9B8
                                                                                                                                                                                                                                SHA1:827CC385D614535A17C37A899017E95ABEE90384
                                                                                                                                                                                                                                SHA-256:D35630AC31C32CEB5098EB2E63B029EBEE37167C6DA320F07574A244A8336554
                                                                                                                                                                                                                                SHA-512:5BAC1699C2B11FBA9A25112672DC30F2DD7A1058161066939667F467470CDDACF6E8DDBB0AFAAB0395BCBFFE67743231640CD70ACB9DCAD2645743F5F0DBCFF5
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.T~~.:-~.:-~.:-w..-x.:-..;,|.:-..?,r.:-..>,v.:-..9,}.:-..;,}.:-%.;,|.:-~.;-4.:-..7,..:-..:,..:-...-..:-..8,..:-Rich~.:-........................PE..d...q.`.........." .....@................................................... ............`.............................................X.......................H...........D...........................................8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11776
                                                                                                                                                                                                                                Entropy (8bit):6.768385706088112
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:BhVG7AsfBUmejljLpciF5JEw/80/cwDIvkYj273QJXhEDE/wx8p:omjhZF5JEw005IvZa7gJXOE/wx
                                                                                                                                                                                                                                MD5:75BE08C4B0982D2BEE8BFDC3571B90BC
                                                                                                                                                                                                                                SHA1:F131B660569166243CECC1EAEE7EF2427D968D4E
                                                                                                                                                                                                                                SHA-256:871079FF742DD22E944820510D723BF140E69397814BA9F1C1CEE13421CBEB09
                                                                                                                                                                                                                                SHA-512:888CDA61F383C57F6781441B781F2EA4596D4BF24FF9E11DB8DC59D7A244ECAEE7E06BA86A67E32A13E2A5A78C597D013474AFCDA178D38E832E364830603E01
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tf...........m......`.....~......`......`......`.....s...........k`.....k`.....k`.....Rich....................PE..d......d.........." .....0..........0.....................................................`.............................................`...p...P.......p....`.............. .......................................0...8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32api.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):50176
                                                                                                                                                                                                                                Entropy (8bit):7.856075315952315
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:rCqUvYAXWuxLjyimF6As/Z3bGUuvsCVXCaue:rCqwtr/yimoxB3dukte
                                                                                                                                                                                                                                MD5:A5164377C56078FA97E42C4CCD7E3C17
                                                                                                                                                                                                                                SHA1:5D4E05710848E757D52DAA0C2A9DD806FA22D35A
                                                                                                                                                                                                                                SHA-256:B00E9D8604CF0E3436E5F44AF51C352762089D5EED53F84FB109E1EDDF7F1A84
                                                                                                                                                                                                                                SHA-512:63E3D98CA3E1DCE64D0D5F49695CD7B3740154D6D9F6E23A2E84687E54D414C41BCAB07626EA685A350E55A3414EF10FC429910CE06B9AF240B2796C536A6202
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.uV.z...z...z.......z..J....z..J....z..J....z.......z.......z..J....z.......z...z..O{.......z.......z.......z..Rich.z..........................PE..d......d.........." ................0.....................................................`.................................................X...........X.... ......................................................0...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32net.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):34304
                                                                                                                                                                                                                                Entropy (8bit):7.6971745920156325
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:Zzr7HjHd8/GHaJ31sd2rhSky7aY0jDN8CK/yPebpLNf:ZzPHbd8JFsd2rJXYcRKMeZNf
                                                                                                                                                                                                                                MD5:DD20D1245098A40C8729A931B5402718
                                                                                                                                                                                                                                SHA1:228E9EA731D3A2EE8C227C78523F9285314FC6E0
                                                                                                                                                                                                                                SHA-256:9228F21326C91E1FBD620328D8C33B52DB7743943C8890F1EC65287206DEACD2
                                                                                                                                                                                                                                SHA-512:2259793ED01162428FE68C0BB8A2A87577F4129478A179D1151D8332A7190E60B18ACBEF5C40B10CD901DEB01528D3D7E658B0E81D21BF6C4E67A2E214E68594
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:.U.T.U.T.U.T.\..Q.T...U.Q.T...Q.D.T...P.].T...W.V.T...U.W.T.A.U.W.T.A.U.R.T.U.U..T...].R.T...T.T.T...V.T.T.RichU.T.........PE..d......d.........." ......................................................... ............`.............................................P...X...........X...................X...........................................8...........................................UPX0....................................UPX1.............z..................@....rsrc................~..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32security.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):7.823054231458668
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:kvdj32qzofwYTVzIiX8ARibgxe8+ShUV:sdCcoRFXA6rvUV
                                                                                                                                                                                                                                MD5:502D5987825F4F6D4627D6C80088743A
                                                                                                                                                                                                                                SHA1:77FFEDE001A1207D549A3B55625478A866D7E5AC
                                                                                                                                                                                                                                SHA-256:5B3C7EE3E22B1839C1C6C515C03FB31E6E792DB99E825135B281A64A5AB7C252
                                                                                                                                                                                                                                SHA-512:1494D316C7B89ED0DFA620F6914F765CF4BFFCF5B508045D5B1D29719F655947424887A21172F164CA0D5CC018703DE3C5D20FB52AFF2F0B3D6089475F600BC7
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L)i^-G:^-G:^-G:WU.:V-G:.XF;Z-G:.XB;O-G:.XC;V-G:.XD;]-G:.XF;\-G:JKF;\-G:JFF;W-G:^-F:.-G:.XN;]-G:.XG;_-G:.XE;_-G:Rich^-G:........................PE..d......d.........." ..................... ................................................`.................................................h...........h....`..........................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32trace.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                Entropy (8bit):7.096312139520411
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:9mIxvg14DDBoqz0VMUW6u7D5rm4Za7gJXH51BJN:HV+4poPV/W/n59p3bB7
                                                                                                                                                                                                                                MD5:3B821D786242A4BA72F8EAD9FA6DB6DA
                                                                                                                                                                                                                                SHA1:EE5BD3D7919564A1DBD6751DF833089105A5E3C1
                                                                                                                                                                                                                                SHA-256:B890A6781AB64F4EF12F507DCCFD617445362645FCC20963679D627DB97298DD
                                                                                                                                                                                                                                SHA-512:F936C88701EDAF14578F8AB1B5AD530FFD83FB0DD60320D19734EAC48E71C49459D93F66AFF59B78734545C3F2CB9370412D1E0165DC439E22B3B652D84A63D9
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U.bD..bD..bD......bD...E..bD...A..bD...@..bD...G..bD.?.E..bD...E..bD...E..bD..bE..bD.?.M..bD.?.D..bD.?.F..bD.Rich.bD.........PE..d......d.........." .....0................................................................`.............................................T...`...8.......`....p..........................................................8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\win32\win32wnet.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):7.406348326088368
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:+CQ3drserOIUVmRhRgx61UJJ0kKszKHIwZa7gJXLB26tO:+hTU+gx6k4DpbB26tO
                                                                                                                                                                                                                                MD5:014AF0E1EAA9A31EAE687F1EAE823810
                                                                                                                                                                                                                                SHA1:22BCD2192469992935E00CEB2B0B9A8B90A28C9C
                                                                                                                                                                                                                                SHA-256:CACEEE05760DAEFE177B1ABC915A1ABAB512A7F8B0689DDC600F57301A019C6B
                                                                                                                                                                                                                                SHA-512:2A7D05D89A395D8A948AA31494D9620DB165CD67A5720519597C000615FB7F7215C62A8E2EFFA1BA6AECFF0E683633BFF33819797263DE007DA233AE725D7882
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fTG..:...:...:.......:..r;...:..r?...:..r>...:..r9...:.Tr;...:..a;...:..l;...:...;...:.Tr3...:.Tr:...:.Tr8...:.Rich..:.........PE..d......d.........." .....@................................................... ............`.........................................H...H...X...........X...............................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\_cffi.cp38-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):264192
                                                                                                                                                                                                                                Entropy (8bit):7.9936286609130285
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:3PvqH4ND5vg9tYqXFDy+F1g9xcirKkClmRaGvw0:3PHNDEVGEWxbrKLgYGI0
                                                                                                                                                                                                                                MD5:BB5E0471A4CE96408EA8D3B667AABFC9
                                                                                                                                                                                                                                SHA1:072E7CDFC513580E6291B368546F42E9764F7C85
                                                                                                                                                                                                                                SHA-256:828EE83BE8E6088D3452770301E9888DFA2D48C01BD5ED06922955481F0A1FC3
                                                                                                                                                                                                                                SHA-512:810771F87692124100C2E5275F18505E28DE0A4AF546954F8C8DA1971AFBD2D9BB817B928257B7A3CFC3D30DFAAC20D002CCF8B2F4FE3362E44B74BC2B2DA954
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*...*...*...#.8. ...e..(...a..(...e..'...e.."...e.........)...*...b......(......+.....T.+......+...Rich*...........PE..d.....<d.........." ...".........@...B...P...................................`............`.........................................lS..X....P..|....P..........$H...........S.......................................N..@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI56642\zstandard\backend_c.cp38-win_amd64.pyd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):233984
                                                                                                                                                                                                                                Entropy (8bit):7.9891918400504665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:k61SUiamsDELcQvCVd5RYFwDs2dfDgBTgyX75vOIW43whQDL:k4SUrIFvCnYqZfcTVNvLlH
                                                                                                                                                                                                                                MD5:7EEBDF85AFD93370AA72A607049C7564
                                                                                                                                                                                                                                SHA1:A60FA68592F9D3AA06C220C865782FF3E92C025B
                                                                                                                                                                                                                                SHA-256:41A3712D497420B701A938F6FDABC93589D083079A53AFF7EC0F55C8C3A07D32
                                                                                                                                                                                                                                SHA-512:6EEB5AD15DDE41D1A67A3DCA4DEE0DC06CE5D382DC2F2CBAF2B6D04D4CD72785786E4AEF6F345032802B70F13C49282683AD92A064FECF3C0592DABA04F90E74
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t............................................................E...............[.......[.......[.....[.......Rich............PE..d...x.<d.........." ..."............P+.......................................P............`......................................... C..`....@..0....@..........x<...........C......................................P7..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):530
                                                                                                                                                                                                                                Entropy (8bit):5.999391385907715
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
                                                                                                                                                                                                                                MD5:06ED2CD304730F55A5C7001509E128BE
                                                                                                                                                                                                                                SHA1:49651485B2CE3D239172BD52BF5A265AB3EB8E18
                                                                                                                                                                                                                                SHA-256:66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
                                                                                                                                                                                                                                SHA-512:0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893*_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao\History\Firefox_v6zchhhv.default-release.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):112
                                                                                                                                                                                                                                Entropy (8bit):4.9113057226932435
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:N8DSLvIJiMgTE2WdkQVjDSLvIJiMhKVX3L2WdkQVQ:2OLciodFOLciA8dq
                                                                                                                                                                                                                                MD5:0CE7E561D96623E70DD177304D3B56DA
                                                                                                                                                                                                                                SHA1:27B4131817E71657AED90C086E01E7E925BF641E
                                                                                                                                                                                                                                SHA-256:E0B2F92CFB58B7D5EDFBB1FDF3E81194D4E55A90706986C389BDF21D2AD2325D
                                                                                                                                                                                                                                SHA-512:48154E76523305BBB7ED39FEAD22CB4DD6FDD568259DC8D0E70ABA4A21030DAF6D1274E0DC5D7F10DFCF7B3B61BD2401FFB4768F301AEF04F142AF23EF335AB5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:https://www.mozilla.org/privacy/firefox/.1696426831..https://www.mozilla.org/en-US/privacy/firefox/.1696426831..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7547
                                                                                                                                                                                                                                Entropy (8bit):5.491354639898812
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:xzuzzZR4DLc2KBhA6tsxODsexTelURsfS1c19NANUbg3x:xCtODLX6tsxPCuUayc1wB
                                                                                                                                                                                                                                MD5:A16419AE4432CE50BAABDAC21B79BE7D
                                                                                                                                                                                                                                SHA1:8E0FC189039ECA7BCBEB19F62A739DA18C90557D
                                                                                                                                                                                                                                SHA-256:DB37E21FAB4EF3F9162786CA26FAD3B94D83631A0F5DCF37224E41A974912459
                                                                                                                                                                                                                                SHA-512:B4D8A486A895AF780DA44C4F92FF8F72DF7E46B927952DCCBF2BB2DF1BC72AD915C0793C94C9B497CCB83BB58D22A6D0D650CEE8EC97827DABBD98B68D7C91F1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:Build: default..Version: 1.9....Date: Fri Apr 19 00:40:47 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 54a29e1882c07f6d2075588f9ee6dd84....Path: C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 302494 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 19/4/2024 0:40:47..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe4Oj_OpvPYvao\screenshot.png

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):524499
                                                                                                                                                                                                                                Entropy (8bit):7.922414823903577
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:7lW99kz+rkvjWKbraKxBpl+h2o+LNyDoG8zmQf2BldH5jd:hWEz+r2jhba8fQwEz3
                                                                                                                                                                                                                                MD5:F8454CAB7050FF7BA7FAABFF4375A04F
                                                                                                                                                                                                                                SHA1:13E9D62B87DC5867C9C911C50203EAC81D079E18
                                                                                                                                                                                                                                SHA-256:082ECCDF4206C2502637D43D33D29A22E9913CC4B908D56EC0D81E4BFA4C717A
                                                                                                                                                                                                                                SHA-512:300882F379BD6011B8378F3C9F2CC204A84F4553DC2AA24960CC1C8048C4C5120ED13D130733C38F6959F3273D2C7105D812D2FFF678D87ED58C2DD3E66E1463
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....%.u..g.{U..P......Hi..5Zifg$.hHA#.D....{....C........h.wh.o..{..F"...x.{u_V.....He..1"n..z]...NDf.\.Y.Z>.{...Z4.m.+>....Cr..C.:.^...K........D.....P.>..d.u.^.aH~.A..bC...(...#9..A..WNz.{..s..$g../...{mI.u......'.i..S.n.}l.INy._d'.;.Io6..Iz...";......)._..Y...W.Mr..MjG...........)l~?H..5.../6.~.......Dz.s9......F..g.R+.}.....|.VBv........jO.`./....jK.r......k...D....?.).X...>.7....9....f.G...z..~...HHv.8t..X...h.j.?..v{8..|[9.....<A.5.]...n.kB'.x...xm...]-nt.fk...8.;..........s.[c.U.....m.i...:vY.c.;...;Y........v+C..l.<..w.d.f1.....;...,....b.G.I......1.5['.zY.},..Q.!..mV..mm.....ml.H:..fl..kB.....}.u.66.k[w.!..4..v?3.F..KB:mq....]..d...H}k....R.c..~.N..;./.......Sl..#...Z|...jg..Fj..Y..[..j..D.y.I..D...E!..0.;'.....q...~.6tL.u]...s..&..66..[.~}..].j...&.<A.q`l.d..-..i'#.t.......c.....c.....k...u'96...p[....]..8g.}.c.^..z...'...

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeaHCIG8PSNyiV\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):530
                                                                                                                                                                                                                                Entropy (8bit):5.999391385907715
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
                                                                                                                                                                                                                                MD5:06ED2CD304730F55A5C7001509E128BE
                                                                                                                                                                                                                                SHA1:49651485B2CE3D239172BD52BF5A265AB3EB8E18
                                                                                                                                                                                                                                SHA-256:66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
                                                                                                                                                                                                                                SHA-512:0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893*_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeaHCIG8PSNyiV\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7427
                                                                                                                                                                                                                                Entropy (8bit):5.445583647573935
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:xpF6ZR4GLc2KBhA6tsxODsexTeVRnZf1c196ky4h3CANUbg3x:xuOGLX6tsxPC2ndc1Q0B
                                                                                                                                                                                                                                MD5:9028E226744E45C5BEC1277645DC841A
                                                                                                                                                                                                                                SHA1:8877CFFB214522AEC0247A01EFE2FC9C819FA82B
                                                                                                                                                                                                                                SHA-256:C74FDDEC3072638C6FDC94CC872515E69A4C4EDD34744BDD8534DC2EF8180888
                                                                                                                                                                                                                                SHA-512:7CE2BCF351470FA72AB554BE4511038A3853D71EE4BAD51BF40FD0D02FBC5906031AFD6EAAE8BF1FDD5973DC235C5185F54D041D87E0A8E4F847C6D9062AA5F5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:Build: kedro..Version: 1.9....Date: Fri Apr 19 00:41:27 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 54a29e1882c07f6d2075588f9ee6dd84....Path: C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeaHCIG8PSNyiV....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 302494 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 19/4/2024 0:41:27..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.e

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeaHCIG8PSNyiV\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\3oQkzNzBij_CLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\5t6Ii1XbIVZuHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\7LZpu8lYLaL6Web Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\E8RYa_H9TXAVHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\EELYLfejcLztHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\Kd8a5INUbh_VWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\OLxn5hD6ZfoILogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\P4dxJ14wREOnWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\RDDdhvukKjzsCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\VwnlUULp97YQWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\YKYmNSWBkAcFWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\bynA5XZaUopLU9g6Euj0.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):315904
                                                                                                                                                                                                                                Entropy (8bit):7.9900301024348765
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
                                                                                                                                                                                                                                MD5:C60F5FA3A579BCA2C8C377F7E15B2221
                                                                                                                                                                                                                                SHA1:D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
                                                                                                                                                                                                                                SHA-256:F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
                                                                                                                                                                                                                                SHA-512:F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]*....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2.*...................(....*n .........%.....(.........*.0..H.........89.....P......%G ....X.R.P....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\evAdx9NnKTiHWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\i9bQUwb0gVdGCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\p508E0L2OxcFz21C_cBt.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\y_jGoRJzS0CJHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi4Oj_OpvPYvao\zdJpjA1Mr6mVLogin Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\7RW6jxyALX6jWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\Abza6rTCIaCdLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\Gw8YbJCdnZfMHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\KKExVKdj4NSpWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\MB0fXnRaDxXiLogin Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\MMzbRQzkD7lAHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\S6WYp_gBHkLSLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\T8nIqmgbl1ivWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\_4tm9JEac10JWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\hxJHbsgHe7kjCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\m2TmXBHr7008History

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\t0QvqjZ_6d3hCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\vXCN5za2dAGwWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\vw988PZTRRB5History

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiaHCIG8PSNyiV\yq9RQpgAvGCGWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_RegDLL.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2048
                                                                                                                                                                                                                                Entropy (8bit):3.958860502702431
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:iBUZnkv1z1iyDuivJlEt/QJSquEMx5BC:+SIz1BqivJA/QMx5
                                                                                                                                                                                                                                MD5:054EED91B90C8066725331381C056A0B
                                                                                                                                                                                                                                SHA1:1A6ED65573F5F2E0664F32518B43B8B8CD7E14E0
                                                                                                                                                                                                                                SHA-256:17DB74C713E0C12DF74245243E7A63E75815E4F4D6FD9FECA2D4D38041DD6EF0
                                                                                                                                                                                                                                SHA-512:89FC23CDD9FC5DC61FDF5A3BBC902FF3B2D5E609F331E10CF4C4C76DDCDA3C69D1EC23FF6705A3855FF0290B0CF926328A7490A36EA39CA8729E657E55271A18
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y$...E...E...E...J..E...E...E..:...E..:...E..Rich.E..................PE..L.....D..................................... ....@..........................0..............................................d ..<.................................................................................... ..<............................text............................... ..`.rdata....... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2560
                                                                                                                                                                                                                                Entropy (8bit):2.8818118453929262
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
                                                                                                                                                                                                                                MD5:A69559718AB506675E907FE49DEB71E9
                                                                                                                                                                                                                                SHA1:BC8F404FFDB1960B50C12FF9413C893B56F2E36F
                                                                                                                                                                                                                                SHA-256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
                                                                                                                                                                                                                                SHA-512:E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4608
                                                                                                                                                                                                                                Entropy (8bit):4.416719728245179
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:68tbXKoGQ6oNrP/MXebrvrMTtFcEBO3K8/wzTqkO3KExygKBDM3f8:PX6Xe/DMTtWE0/wz5sxyblMv8
                                                                                                                                                                                                                                MD5:42BF074B99A445614BD19C6E5724A01A
                                                                                                                                                                                                                                SHA1:A07123ADBE7FA8BBD4A001332DC08AA6D3B5AEC0
                                                                                                                                                                                                                                SHA-256:0A6C41612400C3400466A0583DBB0E6C9BD310393704807E4F9617AA53ABDED6
                                                                                                                                                                                                                                SHA-512:58279D4DC7A09990302E73CB602FE3E1B1F7F8E5A0A5CD83760F99E093701F15C84BAE9692F9A4B61925F42272DFA56FED0DB8CDFE00EF509F88E91C22E185A2
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...$...$...$.......$...$...$......$......$..Rich.$..........PE..d...hUbC..........#...........................@..............................P...............................................................!...............@..H.................................................................... ...............................text............................... ..`.rdata..l.... ......................@..@.data...,....0......................@....pdata..H....@......................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-0T16J.tmp\_isetup\_shfoldr.dll

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):23312
                                                                                                                                                                                                                                Entropy (8bit):4.596242908851566
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
                                                                                                                                                                                                                                MD5:92DC6EF532FBB4A5C3201469A5B5EB63
                                                                                                                                                                                                                                SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
                                                                                                                                                                                                                                SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
                                                                                                                                                                                                                                SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):663552
                                                                                                                                                                                                                                Entropy (8bit):6.4687980579745945
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:XeuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYZajlxp:uuHcrgVxrPy37WzH0A6uwkNK4Klxp
                                                                                                                                                                                                                                MD5:823E80C325207F495A59B69AAE8AEFAD
                                                                                                                                                                                                                                SHA1:4F6C6C696CFD47CF3571B9931829BFDA1D2FDA55
                                                                                                                                                                                                                                SHA-256:520737B28D4086412E0CB4C8ECBD5E7273360D523866EBABCF1A8ECC93663EF0
                                                                                                                                                                                                                                SHA-512:BE73D771F3E313D0244449FD6E0D4B49D10088672B082ADD4A28CFEC36D48C13393B7BBFB0B495EB2ED9D9BA525F304EDB8F2353E28AC6FFFB0053AC2407A463
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nyv8h1dp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):2.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:qn:qn
                                                                                                                                                                                                                                MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:blat

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\rage131MP.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13
                                                                                                                                                                                                                                Entropy (8bit):2.7192945256669794
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:LzWWASX:+Fk
                                                                                                                                                                                                                                MD5:E39BBB01EB594341CDAD1A71A2036961
                                                                                                                                                                                                                                SHA1:1F7D595E1D67C244755D0F3A12134C587C0CDDC2
                                                                                                                                                                                                                                SHA-256:57E90E27E4066A191DBAB8F5348855DE8CABB4C84512A316268D89D94219364C
                                                                                                                                                                                                                                SHA-512:D95A0EAACF0E533653BFD8F542CEC024B89F819E4FC148AC1D1D81F1966638C71BFFECAE016C8AFD5124DEF25A28B6984326BBA0780189D345F9A9D593A449C2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:1713483812572

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g\gen_py\__init__.py

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                                MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                                SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                                SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                                SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpx_3rmj6g\gen_py\dicts.dat

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10
                                                                                                                                                                                                                                Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                                MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                                SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                                SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                                SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..K....}..

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2251
                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                                                MD5:0158FE9CEAD91D1B027B795984737614
                                                                                                                                                                                                                                SHA1:B41A11F909A7BDF1115088790A5680AC4E23031B
                                                                                                                                                                                                                                SHA-256:513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
                                                                                                                                                                                                                                SHA-512:C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\fcegbwt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):245760
                                                                                                                                                                                                                                Entropy (8bit):5.30257092816603
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:agL5D7I860Lvdu97u5Hs1eRlMKUa1L7TVf1:ZLFI86Oe7BuPU2L7B
                                                                                                                                                                                                                                MD5:9C100E7F219C7E05CCEA1899C511F4B9
                                                                                                                                                                                                                                SHA1:2B9B7E9868E50A4A937BCC1DF238BF0FDF2CDDAA
                                                                                                                                                                                                                                SHA-256:412A2FD5813DF7D330EE426CC11BEFAA40D614171C126FF156F87D7E0325F1E4
                                                                                                                                                                                                                                SHA-512:438F59AB41D88EEC95E9D07E9100AFF4581433E52F7FF90D209AD84E37404AE5AF1509A5FA84BF7976B814BF860E4E0BD7400FCC0074A5F56E4EDAE9E48AB36F
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L...5(Yc............................N.............@.............................................................................(....................................................................................................................text.............................. ..`.rdata..............................@..@.data....$~......(..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):313344
                                                                                                                                                                                                                                Entropy (8bit):5.672834768095049
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:tfzL24gRDCHj373rDz9EZiZRcy1q1pFsRmqBCICURFIt7T5dmdf1:tLTgR4EZLn17sRmqQI5It7O
                                                                                                                                                                                                                                MD5:5E2A97C7C4BDD77D61B82E3C8454C0F1
                                                                                                                                                                                                                                SHA1:A8EA9BDB5C412C950100D3A32A43A8D3849805F4
                                                                                                                                                                                                                                SHA-256:E8C0E2C462A9FA176F5E843510B5DDF9F0E124F2620DD5CFFF44583E931F09FD
                                                                                                                                                                                                                                SHA-512:43E3A0A09A72DF46605AB97CB144A94774D7299AF5F1969265CD3A101D3A21F32DCB86219CEE9CE31FC19AA671EBBBAA3EF7533CDD3FB4D7B6B82173D603BA10
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-...~...~...~..2~...~..$~.~..#~...~.U.~...~...~...~..-~...~..3~...~..6~...~Rich...~........................PE..L......c.....................PD.....N.............@...........................D.....fK......................................,A..P....`C.8w...........................................................................................................text............................... ..`.rdata..............................@..@.data... .@..P.......4..............@....rsrc...8w...`C..x...P..............@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2182516
                                                                                                                                                                                                                                Entropy (8bit):7.931158977462107
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:1monDh6QIKOuye0htC6qz6yobPKhbxGup9nsKH3rYIa6QRwjrnLJwo:1moVP0hXyoGhbsup9jrfQRwzP
                                                                                                                                                                                                                                MD5:68B27A8882FFD2A01203CC218BD80849
                                                                                                                                                                                                                                SHA1:8DA8AE01F3DF3E942E67A9A36A837F854E0BB2E9
                                                                                                                                                                                                                                SHA-256:A7EB93395FCD72C045613D013D995A5C2EB3123C19EDDCEA245C94358B5B19A0
                                                                                                                                                                                                                                SHA-512:AD54B94C62DCCC70FD1211691BBFC27536508EC2B7BC72CEFC51D5E98451A30789F88D4A99B767CCF47B4278FFAE4A41DB1A03706A5B97ED76089E907AC7B50D
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y..y..y....~.y....|.!y....}.y..+.r.y..+...y..+...y..+...y.....y.....y..y..x..%...y..%...y..%.p.y..%...y..Rich.y..................PE..L...R.xe...............!..................... ....@.......................................@.............................4...$...P.......`.......................</.. ...T............................F..@............ ..L............................text............................... ..`.rdata..4.... ......................@..@.data...x...........................@....didat..|...........................@....rsrc...`...........................@..@.reloc..</.......0..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5077008
                                                                                                                                                                                                                                Entropy (8bit):6.713226173072206
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:AZ5VfUpCCTIDsAi8LXS2vwJ1EbfdOq5elO:Axf8ivmOfdOq5elO
                                                                                                                                                                                                                                MD5:D15459E9B9D12244A57809BC383B2757
                                                                                                                                                                                                                                SHA1:4B41E6B5AA4F88FDF455030DB94197D465DE993A
                                                                                                                                                                                                                                SHA-256:37AEF611EC814AF2CDCFA198E200CB21ECB46CAA30F84D0221A47DB1265B889D
                                                                                                                                                                                                                                SHA-512:40558644CA9918B84A9438A3A2C4D85A97DDEC378AED23756E14C57351D4B4C82D6316ADD1E62243826328E42C766784CEE5D6CAE41C6FA6C43864F5097A239C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rs... ... ... ...!... ...!t.. ...!... z". ... z".!.. z".!... z".!... ...!... ... ^.. K!.!... K!. ... ... ... K!.!... Rich... ................PE..L......f...............'.....:........:...........@...........................\.....E.N...@..................................@$......@..._....................\..............................P$..................................................... .........l.................. ..` ~............p..............@..@ ............r..............@....rsrc...._...@...`..................@..@ ......#..R..................@..B.idata.......@$......4..............@....tls.........P$......6...................themida.@8..`$..@8..8..............`....reloc........\......xM................@........................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4825088
                                                                                                                                                                                                                                Entropy (8bit):7.363795425961208
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:dPwGDPsMTm7Gh0nUu7TcY0mmdlv3GLCjcKbbygH:dPfDPtqGmnUu4mmdlO8bbyg
                                                                                                                                                                                                                                MD5:15A5A210A88D15A932171A9FA25A1356
                                                                                                                                                                                                                                SHA1:7F6290046BD9BB6129AF3DA4612FAD50369EDA09
                                                                                                                                                                                                                                SHA-256:6A92C749F157EC43B1D14CFBA29F9CE164ECD3048353A720089F872F13B843FE
                                                                                                                                                                                                                                SHA-512:6738CC6366DA9561DF4B87F099BBA64E56DB7421598C2DDA25BE2933052BDB7593B7B386671F222B1E509A73F54CA982FEAE27FE22D57B6AF82A0B30FFBED258
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: Joe Security
                                                                                                                                                                                                                                • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: ditekSHen
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6...............P..ZH..D.......xH.. ....H...@.. ........................J...........@..................................wH.K.....H..@....................I...................................................... ............... ..H............text...4XH.. ...ZH................. ..`.rsrc....@....H..B...\H.............@..@.reloc........I.......I.............@..B.................xH.....H........p...............q....;.........................................6+.(.)lj(....*..:+.(4.Uj.(....*.V+.(xU.I..(....8.....*..B+.(...<~.......*...6+.(K7QO~....*...0..........+.(..hS ........8........E........5...&...8....s......... .....9....& ....8....*s.........8/...s......... .....9....& ....8....s.........8....s.........8........0..+.......+.(..578......*8....8.....~....o......8......0..+.......+.(i'Nb8......*.~....o......8....8....8......0..&.......+.(.\J>.~....o......

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11214848
                                                                                                                                                                                                                                Entropy (8bit):7.97772484802616
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
                                                                                                                                                                                                                                MD5:B091C4848287BE6601D720997394D453
                                                                                                                                                                                                                                SHA1:9180E34175E1F4644D5FA63227D665B2BE15C75B
                                                                                                                                                                                                                                SHA-256:D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
                                                                                                                                                                                                                                SHA-512:A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\Gon5N1KYkyaNFzeeJDoj76Fi.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (18154)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):284756
                                                                                                                                                                                                                                Entropy (8bit):5.13931611367937
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:qWSLFywkNnTbN/ajDzweCRs0kxkQlNW5fOTHg0mRU0ebgYnIY6/u8:NnF/aBCRpkx9lYN0gYnIY6u8
                                                                                                                                                                                                                                MD5:C99B3B3221D2F3BE1F5406A2BD07117E
                                                                                                                                                                                                                                SHA1:194ACB875A573FC47DD234535BD5679EC8B2C5AE
                                                                                                                                                                                                                                SHA-256:E1671FCEBEE6A7CFB7F850D9C6FC44C10C9762453F83551DB0079FD4928E5827
                                                                                                                                                                                                                                SHA-512:A2128A436256A58A7F68475E00CB3E223B446BA813A1B001D66DB03EE7D814D93D7CE3F1DCCEB4C0F62A5CE85A7BC3276E72731882544161CDD94DDC50238662
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace(

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11440768
                                                                                                                                                                                                                                Entropy (8bit):7.9956456855740825
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:196608:TgfL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugauo0LRmVj:GQLKg+4qH2AoEOgv3Jx/VMW1sAgau3RK
                                                                                                                                                                                                                                MD5:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                                                                                                SHA1:FC3DFD511D75828C56AEC3BE55931D42BFBDD96E
                                                                                                                                                                                                                                SHA-256:95256B28DFB85F1D5BAFDEC109950775733D4AF82ACC0512151639695C57E469
                                                                                                                                                                                                                                SHA-512:BA686693DE8C474D819CA65E6D44AE0D32AAE82F71FAA40052C1ACE81CA0452C590780FAB13601930DE04C3426430EE4B93B2A3870357738E13B1D60AADD81DF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................1...........-......................................H......H......Rich............................PE..d...4..e.........."....".....R.................@............................. ...........`.....................................................<.... ........... ..............\...P...................................@...............P............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..\...........................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4262400
                                                                                                                                                                                                                                Entropy (8bit):7.958883899861744
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:Dt81SR47yhP+/yTfNouW6t+Z1t0+RAN6kbXLS:+1SqGZYyTfNop6tq
                                                                                                                                                                                                                                MD5:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                SHA1:E03C43316545028A3B3F7430055BA129F14F3B31
                                                                                                                                                                                                                                SHA-256:9C86C08E27B93BDE1E12CA865877F4AF82C558940BA77A4C9D0CD24361244E70
                                                                                                                                                                                                                                SHA-512:C1FAB936F4293C8F1B062A14AB93479E2AD6C2EB127E127E269A3094C4B9B5D872A75C7AA0A065EEB7B5E5B815C594596E9C03D0C91D105C84677E051B2BCB93
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........8^......P....@.......................... ......!.A...@.........................@T..J.......,.......F|......................\.............................t.......................]......a^.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RF|...P......................@..@.reloc..............................@..@.edata.......p......................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......P..................... ..`.vmp(.R......].....................@....vmp(.R.f=...]..h=................. ..`.reloc..\............p=................@.rsrc...F|.......~....=.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):399360
                                                                                                                                                                                                                                Entropy (8bit):7.547061703214426
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:aawlim1k/G14hCN9OGY13/cpLJsX9s3B6aW4LD0qe30hLxScv/1TDIY6O0:lm1k/G12CNUap9oL4Loq/xSclQBO0
                                                                                                                                                                                                                                MD5:0BB19EEF181634DC1AEA014783928EFB
                                                                                                                                                                                                                                SHA1:45675A35430D2C9DA1BEC9FBB71278EAD2307BB9
                                                                                                                                                                                                                                SHA-256:EFB54CED1C0F4E2D143763CEEC232D61D9DC5C41AD83D62A37EB630F209F0CA3
                                                                                                                                                                                                                                SHA-512:9FD0B06A84A51AFBE3AAF6132F563DF1E1F72E01D5B03B5AC08A1413E80F900A3D2106A64A4AD710ABE2C1C2DDE5BF8A6EA7C392BA07DD77A48AF8B5EDC00323
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OW.h.W.h.W.h...k.[.h...m...h...l.B.h..tl.E.h..tk.C.h...i.R.h.W.i...h..tm...h..wa.V.h..wj.V.h.RichW.h.........PE..L....@!f...............'............T[.......0....@..........................P............@.....................................<............................0..................................... ...@............0..H............................text...?........................... ..`.bss......... ...................... ..`.rdata..0....0......................@..@.data....X.......L..................@....reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6990535
                                                                                                                                                                                                                                Entropy (8bit):7.99641413191419
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:196608:91O72zjVpYD8vDwJmaHxbS2Os9qP0eEgHxh:3O72tpRvDqRbhOZ0fID
                                                                                                                                                                                                                                MD5:442D026B2FA7E3CEB35BB40D28065A7D
                                                                                                                                                                                                                                SHA1:F44BA810E87D6EDCBFE5C48FD49B286CB5E522EF
                                                                                                                                                                                                                                SHA-256:F89F3EDBD31E9171BC4B713EF347ECEBF13A2DC8AB815F064C87EB1E398F3D21
                                                                                                                                                                                                                                SHA-512:3B5F7AFF3A0C58A791B7F7423B2872874FD9ED3490A3D324E23B8A45002E0BDF39FCF5DB049F548B31E4255BF64FD949C2925802634901538F60092F5F01AC26
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6153216
                                                                                                                                                                                                                                Entropy (8bit):6.377641735642354
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:W/Ce4+1N237v0gM68DXYDqwLvws0EdRGtVpT1kTNkbNbQWSxR9DzNJyEv5j/ujOJ:je4PLs6VKOQpyJWSxR9vBEAm8dJT1
                                                                                                                                                                                                                                MD5:817C11005CA185252E666C25769A2591
                                                                                                                                                                                                                                SHA1:E52EC29D0E10C63B378B919FA1F5839B714BE07C
                                                                                                                                                                                                                                SHA-256:353ED3726F653A8E19C5C1511088AE21F3673D992A1781C100DEC7E8418A7FC8
                                                                                                                                                                                                                                SHA-512:B7CB060C4CABBB926E8A40ADF797F9B082F6BAC87A97B984AA6A636D82CF873B5657026B43D17359FFA1CEE1F9EACCED591F6C03E747B3D63090A4BC3D0FBF9B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..&...]................@.............................0d.....}.^...`... ...................................... b.N....0b......pb.G....@[..............Pc..............................,[.(...................|4b.@............................text.....&.......&.................`.``.data.........'.......&.............@.`..rdata........,......|,.............@.`@.pdata.......@[......([.............@.0@.xdata..D....0\.......\.............@.0@.bss.........@\.......................`..edata..N.... b.......\.............@.0@.idata.......0b.......\.............@.0..CRT....p....Pb......0\.............@.@..tls.........`b......2\.............@.@..rsrc...G....pb......4\.............@.0..reloc.......Pc.......].............@.0B................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4566528
                                                                                                                                                                                                                                Entropy (8bit):7.912836436246153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:fznH0igjVHIMouW6tvHCQEUuM9/0MuOEi59WtWYbrNVn1Jx:rUiiHbop6tvHCQJuM9cM3GhX1
                                                                                                                                                                                                                                MD5:3F9AE180E3D7B62BC7C5DD2CEEC62A56
                                                                                                                                                                                                                                SHA1:6DF088E5A0BA89C7607617458F308315FCA208FF
                                                                                                                                                                                                                                SHA-256:3126908E14A21FC38FF213F8B640D8E87ABCC685D7478F4B5A1D99B332E752EE
                                                                                                                                                                                                                                SHA-512:C050A5E24CE54E0565B25E95F9BAF21F324CB3CF3F606DF947E3A1973418AF71BA0537A0A1C319B3F6782C0B102A65CB539F97B96499336F9A4F5203F4429351
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...@........i......P....@..........................`......'.E...@...........................j.J...`.h.,.......&.......................d...........................p.v.......................].........@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.R&....P......................@..@.reloc..............................@..@.edata..............................@..@.idata..............................@....tls.....................................themida.@8.........................`....vmp(.R......S..................... ..`.vmp(.R......].....................@....vmp(.R .?...]...?................. ..`.reloc..d.............?................@.rsrc...&.............@.............@..@................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\f4Y7IGUXRMqOH79zw7TPvsbX.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (18154)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):284741
                                                                                                                                                                                                                                Entropy (8bit):5.1391849486644965
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:qvSUFywkNnTbN/ajDzweCRs0kxkQlNW5fOTHg0mRU0ebgYnIY6/u+:znF/aBCRpkx9lYN0gYnIY6u+
                                                                                                                                                                                                                                MD5:5E6D630E01897C79797904F7ACFD3FC1
                                                                                                                                                                                                                                SHA1:5B0A0096FD093E126DFC76D157E7C9F50600D1D7
                                                                                                                                                                                                                                SHA-256:EB05E363C6B92D3834208EB39BA3909416D82E5770D6C2EB9DCE2991416E1ED8
                                                                                                                                                                                                                                SHA-512:E56FCFFABFA3892917AEB18050F0619D8F581153785FCD1948F5EE43BE6D893E1F9D351B8E367CCDC27A55384944694C7E56ECD0C05F1C4844C556D6AE7F5675
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace(

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4355464
                                                                                                                                                                                                                                Entropy (8bit):7.95371205237782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:mRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9UZ:rUuqUAddtM55murAiy9I
                                                                                                                                                                                                                                MD5:8B65C04554FDC08623E5A74F8F9B9FD2
                                                                                                                                                                                                                                SHA1:2EDA34FBA02FDE8495B70060623C64D8938C82E8
                                                                                                                                                                                                                                SHA-256:23E9BE12F1A03F88CA40CA44E5C9727FA0379C277B2FFC7C54114EC7878F3E15
                                                                                                                                                                                                                                SHA-512:64D6CDA2AEF8D337D5561CE59170431BB76CA4A00FF66E7D61F2F77622F0E68EA5F31B7459321B3F161A182D943A0ADB7C09C21C3DEFD70A23A4A00410BF3A86
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L....F.e.....................B......N.............@...................................B.....................................|vA.(....................jB..............................................................................................text.............................. ..`.rdata..b.@.......@.................@..@.data....$~...A..(...hA.............@....rsrc.................A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3980561
                                                                                                                                                                                                                                Entropy (8bit):7.998343411887219
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:49152:qGahHoFARdcJe5gQSh+rg2glltuEJsmsdQIOCwtRLeynJt4NvPaGIWMEjI9Vt58i:7axZczQSojKEMVhGIWd+gp4rCB+Uy
                                                                                                                                                                                                                                MD5:03DA9FDAF31B27C888D1331D69DC9EF8
                                                                                                                                                                                                                                SHA1:618019BD40E76D7E4F07E917E6293D39D1206927
                                                                                                                                                                                                                                SHA-256:3A1BEABF5EE54F773E098CE19E25BD0280761ECC5A2D8BE970987C0B970DF292
                                                                                                                                                                                                                                SHA-512:BB57C39C9AA307C0CA2D4343A3AE11EF43740DBE4E2BC1CFD7979226446D312D1FF1A1C01DE28138AE55C2BBAF9F85FB902626D1F92CF92ECBD3FC079F669F6E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B....................@..........................0...................@..............................P........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\nACncdsaVw77ipiWE_oU4TxJ

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):38030
                                                                                                                                                                                                                                Entropy (8bit):7.945390952437143
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:fvGiAXYBH8ysANcDYSAFj1HZAozxCM7h61eemOVMXAp+Rbcqe3lLKqmtmqFms:fvLH8D3AFj1TxBhNfRbBCL3rqr
                                                                                                                                                                                                                                MD5:ADA441D7150DCF4C9BEDB5F379498D11
                                                                                                                                                                                                                                SHA1:2A496CD0464108045007A8DA056D4E75181BBA14
                                                                                                                                                                                                                                SHA-256:9E8E2D15AE62DED072E3000D3DE92A74832C077F3129186A8D47D45A35E65AA7
                                                                                                                                                                                                                                SHA-512:4CC4AA78665BD354C24090E252C83D593BDB21EB86A2482BF9C389707B0F743F22774BF799974D2B6757FB9CB1D371B2BE714B671286553FE1F2EAEF007F8313
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........{.73...u.....[.....q+..m8..V2 .R..N.........\H,...R...5...<..a....'..p.L.2.4p..u..4.$.\.....K..S.W...'&l.?..|..X.l.x^..i.#.o..\.....{.e.i...{....EC.x.8..Q..}A.r..*i.O.Bn...'......c`......'.#.U{...Cr.../...J.G.d...+..N*...k..*`...p.D.P.k.0J.......0.."0...*.H.............0.........:Jc......[a.r....B......u.o..t.%$...m.A.S..!...:O.I..EsdWS./0...?.@su.V..w..s..j..!_.:.e......?..EO..'.).#.G..XR..........,Hy6W.@4......k..........T.....3....Y..4..q....,.0....\EU..T".@e....#..d..A.../:<..{Z..l.......V.._.G.5i......F...Z.+..............n..i.d.q.....b.`....i...R+K.T._.p...zB..R......c....{7I........g...z.V.."...dm.w....8...0i.\.m>JP~;T.i;|......~.L.\..3l...

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):921600
                                                                                                                                                                                                                                Entropy (8bit):7.559067836582103
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:qqTm7F2KYgS5KTXxvmwT5aL4P8zre91t9olr:2FXO5KTXZJ0LOAatmr
                                                                                                                                                                                                                                MD5:65BE3195B801D271E01D41F7BF576BD8
                                                                                                                                                                                                                                SHA1:9E20D649EE0884F8800EF67315CAF56C7A6EAA03
                                                                                                                                                                                                                                SHA-256:EE877A4CAEC81C88DDD006C50A8196EADABE873CC6456ECF0D93150E839BC915
                                                                                                                                                                                                                                SHA-512:C84A1863AAECE69B04BEACCD20BF74B1F5BB691D8B401E8613BAD717F5E5A94940E1B129B33AE3EB62E2D62EA988E904388F2E3B1AC35828B4441800FACF6F4C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S..D=P.D=P.D=P...P.D=P...P.D=P...P.D=P.FP.D=P.D<P.D=P...P.D=P...P.D=P...P.D=PRich.D=P................PE..L...Z^.d...........................N.............@..........................@..............................................<...<....`..................................................................@............................................text.............................. ..`.rdata..de.......f..................@..@.data.....~..0......................@....tls.........P.......,..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):500224
                                                                                                                                                                                                                                Entropy (8bit):7.6815778446619465
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:93re4RXLKXpN3zZ8+A+PbjNHsX+54YzHiegI5pRO0:3RXOXpNVr4+GEHi4U
                                                                                                                                                                                                                                MD5:B6D1F343014DC55EF2588CA861DB518B
                                                                                                                                                                                                                                SHA1:896F1EB79619BE7DCFE3F3B137A59F2EA2712FD7
                                                                                                                                                                                                                                SHA-256:E5E5D8F93C5B2DF051962B4AEC10D2F75207E6B3113AE85FAA2D810CA4BCF616
                                                                                                                                                                                                                                SHA-512:B015C947158B34241A789B15B248E81E7483A69B519B4DF0CD99614219DEBD8BD57FEDFC05788AB97C23402A17DAC061284AACE69A93951DC1EDFD686ADC2C52
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OW.h.W.h.W.h...k.[.h...m...h...l.B.h..tl.E.h..tk.C.h...i.R.h.W.i...h..tm...h..wa.V.h..wj.V.h.RichW.h.........PE..L....@!f...............'............T[.......0....@.......................................@.....................................<.................................................................. ...@............0..H............................text...?........................... ..`.bss......... ...................... ..`.rdata..0....0......................@..@.data...(...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):245760
                                                                                                                                                                                                                                Entropy (8bit):5.30257092816603
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:agL5D7I860Lvdu97u5Hs1eRlMKUa1L7TVf1:ZLFI86Oe7BuPU2L7B
                                                                                                                                                                                                                                MD5:9C100E7F219C7E05CCEA1899C511F4B9
                                                                                                                                                                                                                                SHA1:2B9B7E9868E50A4A937BCC1DF238BF0FDF2CDDAA
                                                                                                                                                                                                                                SHA-256:412A2FD5813DF7D330EE426CC11BEFAA40D614171C126FF156F87D7E0325F1E4
                                                                                                                                                                                                                                SHA-512:438F59AB41D88EEC95E9D07E9100AFF4581433E52F7FF90D209AD84E37404AE5AF1509A5FA84BF7976B814BF860E4E0BD7400FCC0074A5F56E4EDAE9E48AB36F
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L...5(Yc............................N.............@.............................................................................(....................................................................................................................text.............................. ..`.rdata..............................@..@.data....$~......(..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4355472
                                                                                                                                                                                                                                Entropy (8bit):7.953716307940233
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:98304:uRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9U/:zUuqUAddtM55murAiy92
                                                                                                                                                                                                                                MD5:A37AAFD52FA58B0518A5ABFC1126A3BD
                                                                                                                                                                                                                                SHA1:3D8EB1846A4BB16442012E45675533E44D1F49E2
                                                                                                                                                                                                                                SHA-256:B737257B9C3B41C65049DFF6096F09D2D1EB787A2A7EA92F65B64B86FED5C84F
                                                                                                                                                                                                                                SHA-512:DDEAB36141F0AAA88F56200DBA786681A3CD47ECF4D3E731D015CE0B430571D8845FC1C7449B3EE8058415B9BBCD41024D4F2086E7EB0699385CED41083AF622
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......D...D...D..7D...D..!Dx..D..&D5..D;w.D...D...Dn..D..(D...D..6D...D..3D...DRich...D................PE..L....F.e.....................B......N.............@...................................B.....................................|vA.(....................jB..............................................................................................text.............................. ..`.rdata..b.@.......@.................@..@.data....$~...A..(...hA.............@....rsrc.................A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4444672
                                                                                                                                                                                                                                Entropy (8bit):7.919562736815233
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:HyRpsgSF3ehDeD8Q3BSgwv3oQ631u+xq3Wr1OyT6m51LKPT9ahmCX49Ad3W6t0Sn:Hs23qc8QYpoQqo4JuT9WmCouW6t0sP
                                                                                                                                                                                                                                MD5:12D7B7B63D8EA8B173B69246184905D6
                                                                                                                                                                                                                                SHA1:0EB454A9D47907B5B761AF269568A8B6A0FCC21B
                                                                                                                                                                                                                                SHA-256:43C810E27AF8BF4A41C5CBE94F39BCAA24B92C7F01760E41698156C52A6FF8AB
                                                                                                                                                                                                                                SHA-512:32B45E13E189B6E482214DB1BE6E35FC071AE06EBDE986F71BA8C8AB792EFCFB5CD2E50FF6275AE0831857BE031EE8CCC6BC36E77CAA1290E1847566E6886E41
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...$........g......P....@.................................5D...@..........................w..J.......,....P..V....................0..............................0Pk.......................`..... .h.@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.RV....P......................@..@.reloc..............................@..@.edata..............................@..@.idata..............................@....tls.....................................themida.`;.........................`....vmp(.R......U..................... ..`.vmp(.R......`.....................@....vmp(.R .?...`...?................. ..`.reloc.......0.......&?................@.rsrc...V....P.......B?.............@..@................................................................

                                                                                                                                                                                                                                C:\Windows\Logs\StorGroupPolicy.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):30351
                                                                                                                                                                                                                                Entropy (8bit):4.9171945560392025
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt5X0SHgHgZgZgUgUi/1OkGk1/pprYHHH1N:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrtk
                                                                                                                                                                                                                                MD5:3FD90164054DDDFF56781564585342F8
                                                                                                                                                                                                                                SHA1:610B488728D2121C6C2A698BE89098C8B3B2C4FA
                                                                                                                                                                                                                                SHA-256:CF96C29A3CE89ED195FC4452EE205F6C5AF575056FC6D5D7AAA89F22A58FC437
                                                                                                                                                                                                                                SHA-512:CA51DED7B23962E9E068AE79FD370270DF37D585BBD38AEFD368056CF61A41A6FC7526C047464742292FBAE4EBEE3362CA577DD9D9E2D1896F2E7888BBB39DBD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:10/03/2023 7:55:56.00000693:RegEnumKeyExW failed with (259)..10/03/2023 7:55:56.00000693:GP object initialized successfully..10/03/2023 7:55:56.00000756:Deny_All not set for all. Will query other 6 GUIDs..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Deny_All for all devices is being reset..10/03/2023 7:55:56.00000787:Will delete security for disk..10/03/2023 7:55:56.00000787:Volume interface name \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}..10/0

                                                                                                                                                                                                                                C:\Windows\SysWOW64\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11
                                                                                                                                                                                                                                Entropy (8bit):3.2776134368191165
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1EX:10
                                                                                                                                                                                                                                MD5:EC3584F3DB838942EC3669DB02DC908E
                                                                                                                                                                                                                                SHA1:8DCEB96874D5C6425EBB81BFEE587244C89416DA
                                                                                                                                                                                                                                SHA-256:77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
                                                                                                                                                                                                                                SHA-512:35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:[General]..

                                                                                                                                                                                                                                C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:RAGE Package Format (RPF),
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1926
                                                                                                                                                                                                                                Entropy (8bit):3.310422749310586
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
                                                                                                                                                                                                                                MD5:CDFD60E717A44C2349B553E011958B85
                                                                                                                                                                                                                                SHA1:431136102A6FB52A00E416964D4C27089155F73B
                                                                                                                                                                                                                                SHA-256:0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
                                                                                                                                                                                                                                SHA-512:DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

                                                                                                                                                                                                                                C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):127
                                                                                                                                                                                                                                Entropy (8bit):5.0926418767732935
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsXovn:1WsMzYHxbnvEcvgeyn
                                                                                                                                                                                                                                MD5:7CC972A3480CA0A4792DC3379A763572
                                                                                                                                                                                                                                SHA1:F72EB4124D24F06678052706C542340422307317
                                                                                                                                                                                                                                SHA-256:02AD5D151250848F2CC4B650A351505AA58AC13C50DA207CC06295C123DDF5E5
                                                                                                                                                                                                                                SHA-512:FF5F320356E59EAF8F2B7C5A2668541252221BE2D9701006FCC64CE802E66EEAF6ECF316D925258EB12EE5B8B7DF4F8DA075E9524BADC0024B55FAE639D075B7
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Reputation:unknown
                                                                                                                                                                                                                                Preview:[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=2..

                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Entropy (8bit):7.908095202439953
                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                File name:SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                File size:4'008'384 bytes
                                                                                                                                                                                                                                MD5:193692e1cf957eef7e6cf2f6bc74be86
                                                                                                                                                                                                                                SHA1:9d1f849b57c96ca71f0f90c73de97fa912b691d7
                                                                                                                                                                                                                                SHA256:fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
                                                                                                                                                                                                                                SHA512:d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
                                                                                                                                                                                                                                SSDEEP:98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis
                                                                                                                                                                                                                                TLSH:240622467E8B0AF1C01DCB74D84220AC7127B781DDA24E273AC911189EEB6656F7E3DD
                                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....X........y........@............................. ......b.=...`................................

                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                Icon Hash:0b6b7b63e76430c4

                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Entrypoint:0x14079aab2
                                                                                                                                                                                                                                Entrypoint Section:.vmp(R
                                                                                                                                                                                                                                Digitally signed:true
                                                                                                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                Time Stamp:0x660BF9C0 [Tue Apr 2 12:27:44 2024 UTC]
                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                OS Version Major:6
                                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                                File Version Major:6
                                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                                Subsystem Version Major:6
                                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                                Import Hash:023aae353653db016d3a89da454d1d86

                                                                                                                                                                                                                                Authenticode Signature

                                                                                                                                                                                                                                Signature Valid:false
                                                                                                                                                                                                                                Signature Issuer:CN=\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z
                                                                                                                                                                                                                                Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                                                                                                                                                                                                Error Number:-2146762487
                                                                                                                                                                                                                                Not Before, Not After
                                                                                                                                                                                                                                • 13/04/2024 11:26:20 14/04/2034 11:26:20
                                                                                                                                                                                                                                Subject Chain
                                                                                                                                                                                                                                • CN=\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z
                                                                                                                                                                                                                                Version:3
                                                                                                                                                                                                                                Thumbprint MD5:77E3547D756C42A66CB4426739A242FF
                                                                                                                                                                                                                                Thumbprint SHA-1:A3E3582D69361C09C56050EFDAB96F951FD96C2B
                                                                                                                                                                                                                                Thumbprint SHA-256:7518998411E11FEBA2B334A8272475F043647D34BA731C223E012BD81917BDD0
                                                                                                                                                                                                                                Serial:3A02069D084A9BAE4554635C0DB95A8D

                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                pushfd
                                                                                                                                                                                                                                call 00007F1C14EFF661h
                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                lea eax, dword ptr [edx+3DE2D15Ch]
                                                                                                                                                                                                                                sar esi, cl
                                                                                                                                                                                                                                lodsd
                                                                                                                                                                                                                                inc edx
                                                                                                                                                                                                                                cmp al, 05h
                                                                                                                                                                                                                                push FFFFFFBDh
                                                                                                                                                                                                                                sub esi, dword ptr [edx+3Dh]
                                                                                                                                                                                                                                ficomp dword ptr [ebp+ecx+33AB4F8Ch]
                                                                                                                                                                                                                                test byte ptr [edx], dh
                                                                                                                                                                                                                                pop ebx
                                                                                                                                                                                                                                les edi, ebx
                                                                                                                                                                                                                                xor eax, F10CA3ACh
                                                                                                                                                                                                                                fidivr word ptr [ebx+13h]
                                                                                                                                                                                                                                bound eax, dword ptr [ecx]

                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x78bae00xa0.vmp(R
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xab00000x31cb1.rsrc
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0xa9ec300xf330.vmp(R
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x3d0c000x1dc0.themida
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xaae0000x1564.reloc
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x734df80x28.vmp(R
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x7100000x98.vmp(R
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                .text0x10000x18f9ce0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .rdata0x1910000x470460x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .data0x1d90000xb1980x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .pdata0x1e50000xf1980x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                _RDATA0x1f50000x1f40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .vmp(R0x1f60000x31ca10x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .reloc0x2280000x21d00x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .idata0x22b0000x10000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .tls0x22c0000x10000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .themida0x22d0000x47e0000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .vmp(R0x6ab0000x64e620x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .vmp(R0x7100000x3d00x4003066240cfb3c8658ef9f5e519612b32cFalse0.072265625data0.3770621172411255IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .vmp(R0x7110000x39cf600x39d000f71adcef6efd3518840bf908f48239d4unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .reloc0xaae0000x15640x160026db4b13f572c4c1bf45a7cd2466182eFalse0.18980823863636365GLS_BINARY_LSB_FIRST5.3780643262997385IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                .rsrc0xab00000x31cb10x31e00ce3e161b70785dfd445e45db8549ad53False0.6563332158521303data6.691549152245497IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                TYPELIB0xab03200xb8a0data0.2674128300609343
                                                                                                                                                                                                                                RT_ICON0xabbbc00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.6393058161350844
                                                                                                                                                                                                                                RT_ICON0xabcc680x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.5610995850622407
                                                                                                                                                                                                                                RT_ICON0xabf2100x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.5178908833254605
                                                                                                                                                                                                                                RT_ICON0xac34380xfaf1PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.00040472595383
                                                                                                                                                                                                                                RT_ICON0xad2f300x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.41838649155722324
                                                                                                                                                                                                                                RT_ICON0xad3fd80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.3154564315352697
                                                                                                                                                                                                                                RT_ICON0xad65800x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.27586206896551724
                                                                                                                                                                                                                                RT_ICON0xada7a80x6f3aPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9999297604832479
                                                                                                                                                                                                                                RT_GROUP_ICON0xae16e80x3edataEnglishUnited States0.8225806451612904
                                                                                                                                                                                                                                RT_GROUP_ICON0xae17280x3edataEnglishUnited States0.8709677419354839
                                                                                                                                                                                                                                RT_VERSION0xae17680x3a4data0.45064377682403434
                                                                                                                                                                                                                                RT_MANIFEST0xae1b100x1a1XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminatorsEnglishUnited States0.5755395683453237

                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                kernel32.dllGetModuleHandleA
                                                                                                                                                                                                                                USER32.dllGetCursorPos
                                                                                                                                                                                                                                ADVAPI32.dllRegCloseKey
                                                                                                                                                                                                                                SHELL32.dllSHGetFolderPathA
                                                                                                                                                                                                                                ole32.dllCoCreateInstance
                                                                                                                                                                                                                                OLEAUT32.dllVariantClear
                                                                                                                                                                                                                                kernel32.dllHeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

                                                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                Start time:00:39:59
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe"
                                                                                                                                                                                                                                Imagebase:0x7ff77ee30000
                                                                                                                                                                                                                                File size:4'008'384 bytes
                                                                                                                                                                                                                                MD5 hash:193692E1CF957EEF7E6CF2F6BC74BE86
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                                                Start time:00:40:01
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                File size:55'320 bytes
                                                                                                                                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                Start time:00:40:01
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
                                                                                                                                                                                                                                Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                File size:55'320 bytes
                                                                                                                                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                                                Start time:00:40:01
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                File size:55'320 bytes
                                                                                                                                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\yyfBua979C0ZzSPnCxybIlhk.exe
                                                                                                                                                                                                                                Imagebase:0x920000
                                                                                                                                                                                                                                File size:4'444'672 bytes
                                                                                                                                                                                                                                MD5 hash:12D7B7B63D8EA8B173B69246184905D6
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe
                                                                                                                                                                                                                                Imagebase:0xaf0000
                                                                                                                                                                                                                                File size:4'825'088 bytes
                                                                                                                                                                                                                                MD5 hash:15A5A210A88D15A932171A9FA25A1356
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.2634159423.000000000452B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000000.2237816859.0000000000AF2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.2634159423.00000000045CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: Joe Security
                                                                                                                                                                                                                                • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\Fb9COhEBuDNRhtMnCgGo2QiL.exe, Author: ditekSHen
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\xNcVS_VvZEHfTUaNtkua55mf.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:4'355'472 bytes
                                                                                                                                                                                                                                MD5 hash:A37AAFD52FA58B0518A5ABFC1126A3BD
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000008.00000001.2312742116.0000000000843000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\DLdiRYbSxUKrp0thTehxs0R7.exe
                                                                                                                                                                                                                                Imagebase:0x1b0000
                                                                                                                                                                                                                                File size:5'077'008 bytes
                                                                                                                                                                                                                                MD5 hash:D15459E9B9D12244A57809BC383B2757
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\OPHZ4RYtForDNHqUKDzFdbyl.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:6'990'535 bytes
                                                                                                                                                                                                                                MD5 hash:442D026B2FA7E3CEB35BB40D28065A7D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\8q5xyu0coQILTrboZdACo84I.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:313'344 bytes
                                                                                                                                                                                                                                MD5 hash:5E2A97C7C4BDD77D61B82E3C8454C0F1
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000B.00000003.2314453573.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\f5PK0Fmcntr6Bz8d571_sPMM.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:4'355'464 bytes
                                                                                                                                                                                                                                MD5 hash:8B65C04554FDC08623E5A74F8F9B9FD2
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:3'980'561 bytes
                                                                                                                                                                                                                                MD5 hash:03DA9FDAF31B27C888D1331D69DC9EF8
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\rvzZmTKhzLAk54H0OO5fg4xv.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:921'600 bytes
                                                                                                                                                                                                                                MD5 hash:65BE3195B801D271E01D41F7BF576BD8
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\Hrpxb3VVNyjyS2Of2WrcJREY.exe
                                                                                                                                                                                                                                Imagebase:0x2e0000
                                                                                                                                                                                                                                File size:4'262'400 bytes
                                                                                                                                                                                                                                MD5 hash:399332B0CAB6E3C41A0AA0ED563BED9B
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\B0SLNTT0ZbIxZcHr0SHBJGEz.exe
                                                                                                                                                                                                                                Imagebase:0x2e0000
                                                                                                                                                                                                                                File size:2'182'516 bytes
                                                                                                                                                                                                                                MD5 hash:68B27A8882FFD2A01203CC218BD80849
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\tNKXm3LImvO5in9OelWM8_lp.exe
                                                                                                                                                                                                                                Imagebase:0x800000
                                                                                                                                                                                                                                File size:500'224 bytes
                                                                                                                                                                                                                                MD5 hash:B6D1F343014DC55EF2588CA861DB518B
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000002.2302959218.000000000082D000.00000004.00000001.01000000.00000010.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\wjwNFr_3XWBVO8HOPBPzLGWO.exe
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:245'760 bytes
                                                                                                                                                                                                                                MD5 hash:9C100E7F219C7E05CCEA1899C511F4B9
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000012.00000002.2709843696.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000012.00000002.2710206756.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.2710983086.0000000002EA2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000012.00000002.2710518558.0000000002DE1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\GDL7jRat1qTWaJDTi_iESGFr.exe
                                                                                                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                                                                                                File size:11'214'848 bytes
                                                                                                                                                                                                                                MD5 hash:B091C4848287BE6601D720997394D453
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\QnkREgWvOVM7UiM40Bqj5sWB.exe
                                                                                                                                                                                                                                Imagebase:0x7ff656130000
                                                                                                                                                                                                                                File size:6'153'216 bytes
                                                                                                                                                                                                                                MD5 hash:817C11005CA185252E666C25769A2591
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:Go lang
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\M3c5GcarM7S9e4Fzg9fhkljA.exe
                                                                                                                                                                                                                                Imagebase:0xfc0000
                                                                                                                                                                                                                                File size:399'360 bytes
                                                                                                                                                                                                                                MD5 hash:0BB19EEF181634DC1AEA014783928EFB
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000015.00000002.2292795591.0000000000FED000.00000004.00000001.01000000.00000014.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                                                Start time:00:40:20
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\azloBsQlDmB56PqIarSd7g7V.exe
                                                                                                                                                                                                                                Imagebase:0xc80000
                                                                                                                                                                                                                                File size:4'566'528 bytes
                                                                                                                                                                                                                                MD5 hash:3F9AE180E3D7B62BC7C5DD2CEEC62A56
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000016.00000003.2518467991.0000000006B38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000016.00000003.2518348325.0000000006AC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000016.00000002.2602141465.000000000671F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                                                Start time:00:40:21
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                Imagebase:0x7ff7fe5a0000
                                                                                                                                                                                                                                File size:11'440'768 bytes
                                                                                                                                                                                                                                MD5 hash:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:24
                                                                                                                                                                                                                                Start time:00:40:21
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:25
                                                                                                                                                                                                                                Start time:00:40:21
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                                                Start time:00:40:22
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:27
                                                                                                                                                                                                                                Start time:00:40:25
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                Imagebase:0x810000
                                                                                                                                                                                                                                File size:65'440 bytes
                                                                                                                                                                                                                                MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                                                Start time:00:40:26
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                Imagebase:0xde0000
                                                                                                                                                                                                                                File size:65'440 bytes
                                                                                                                                                                                                                                MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                                                Start time:00:40:27
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Windows\System32\regsvr32.exe" /S .\TaFD.XRA
                                                                                                                                                                                                                                Imagebase:0x7b0000
                                                                                                                                                                                                                                File size:20'992 bytes
                                                                                                                                                                                                                                MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                                                Start time:00:40:28
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\7zSCA9.tmp\Install.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:.\Install.exe /dlhwdidkpGO "525403" /S
                                                                                                                                                                                                                                Imagebase:0xc80000
                                                                                                                                                                                                                                File size:6'897'664 bytes
                                                                                                                                                                                                                                MD5 hash:F8EFB05B940B05FC74801B61B3C0F500
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 34%, ReversingLabs
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:31
                                                                                                                                                                                                                                Start time:00:40:29
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\is-1I1LT.tmp\is-RKCCV.tmp" /SL4 $B0024 "C:\Users\user\Documents\SimpleAdobe\jToGBYVMqv5v7FLLCc3PnzZj.exe" 3625196 52224
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:663'552 bytes
                                                                                                                                                                                                                                MD5 hash:823E80C325207F495A59B69AAE8AEFAD
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:32
                                                                                                                                                                                                                                Start time:00:40:29
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Users\user\Documents\SimpleAdobe\Honz_MBQI6vCkcbyCN3yB4rh.exe
                                                                                                                                                                                                                                Imagebase:0x7ff7fe5a0000
                                                                                                                                                                                                                                File size:11'440'768 bytes
                                                                                                                                                                                                                                MD5 hash:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:33
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\powercfg.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                Imagebase:0x7ff73c4e0000
                                                                                                                                                                                                                                File size:96'256 bytes
                                                                                                                                                                                                                                MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:34
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\powercfg.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                Imagebase:0x7ff73c4e0000
                                                                                                                                                                                                                                File size:96'256 bytes
                                                                                                                                                                                                                                MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:35
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\powercfg.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                Imagebase:0x7ff73c4e0000
                                                                                                                                                                                                                                File size:96'256 bytes
                                                                                                                                                                                                                                MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:36
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:37
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\powercfg.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                Imagebase:0x7ff73c4e0000
                                                                                                                                                                                                                                File size:96'256 bytes
                                                                                                                                                                                                                                MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:38
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:39
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:40
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\sc.exe delete "OBGPQMHF"
                                                                                                                                                                                                                                Imagebase:0x7ff6c17f0000
                                                                                                                                                                                                                                File size:72'192 bytes
                                                                                                                                                                                                                                MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:41
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:42
                                                                                                                                                                                                                                Start time:00:40:30
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:43
                                                                                                                                                                                                                                Start time:00:40:31
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                Wow64 process (32bit):
                                                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                                                                                                                                                                Imagebase:
                                                                                                                                                                                                                                File size:262'432 bytes
                                                                                                                                                                                                                                MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:44
                                                                                                                                                                                                                                Start time:00:40:31
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:3'948'834 bytes
                                                                                                                                                                                                                                MD5 hash:00B640E64C35C1E3F7AD1CB9A979BF2E
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 49%, ReversingLabs
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:45
                                                                                                                                                                                                                                Start time:00:40:31
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                Imagebase:0xad0000
                                                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:46
                                                                                                                                                                                                                                Start time:00:40:33
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:47
                                                                                                                                                                                                                                Start time:00:40:33
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                File size:55'320 bytes
                                                                                                                                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:48
                                                                                                                                                                                                                                Start time:00:40:34
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                Imagebase:0x7ff674740000
                                                                                                                                                                                                                                File size:5'141'208 bytes
                                                                                                                                                                                                                                MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:269
                                                                                                                                                                                                                                Start time:00:41:34
                                                                                                                                                                                                                                Start date:19/04/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:
                                                                                                                                                                                                                                Has administrator privileges:
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:3.6%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                  Signature Coverage:32%
                                                                                                                                                                                                                                  Total number of Nodes:1099
                                                                                                                                                                                                                                  Total number of Limit Nodes:32
                                                                                                                                                                                                                                  execution_graph 25632 92c490 25633 92c4be 25632->25633 25691 922d00 25633->25691 25635 92c526 RegOpenKeyExA 25637 92c57f RegQueryValueExA 25635->25637 25639 92c5fd 25635->25639 25637->25639 25640 92c5db 25637->25640 25639->25639 25641 922d00 std::_Throw_Cpp_error 14 API calls 25639->25641 25640->25640 25740 985330 14 API calls 3 library calls 25640->25740 25642 92c669 __fread_nolock 25641->25642 25644 92c67d GetCurrentHwProfileA 25642->25644 25645 92c691 25644->25645 25646 92c6bc 25644->25646 25741 985330 14 API calls 3 library calls 25645->25741 25699 92bfc0 25646->25699 25648 92c6c5 25736 92bf20 SetupDiGetClassDevsA 25648->25736 25652 92ca7e 25766 922400 14 API calls 2 library calls 25652->25766 25653 92c71f 25742 98daa0 25653->25742 25656 92ca83 25767 a01ea0 25656->25767 25657 92c740 25746 988210 25657->25746 25660 92c76b 25757 989dd0 14 API calls std::_Throw_Cpp_error 25660->25757 25661 a01ea0 std::_Throw_Cpp_error 14 API calls 25663 92ca8d 25661->25663 25664 92c7bb 25758 98d910 14 API calls 2 library calls 25664->25758 25666 92c7d2 25759 989dd0 14 API calls std::_Throw_Cpp_error 25666->25759 25668 92c7ee 25760 98a040 14 API calls 25668->25760 25670 92c800 25761 922af0 25670->25761 25672 92c812 25673 922af0 std::_Throw_Cpp_error 14 API calls 25672->25673 25674 92c82f 25673->25674 25675 922af0 std::_Throw_Cpp_error 14 API calls 25674->25675 25676 92c83e 25675->25676 25676->25656 25677 92c872 std::ios_base::_Ios_base_dtor 25676->25677 25678 922af0 std::_Throw_Cpp_error 14 API calls 25677->25678 25679 92c8a3 25678->25679 25680 922af0 std::_Throw_Cpp_error 14 API calls 25679->25680 25681 92c8b2 25680->25681 25682 922af0 std::_Throw_Cpp_error 14 API calls 25681->25682 25683 92c8be std::locale::_Locimp::_Locimp 25682->25683 25683->25683 25684 922d00 std::_Throw_Cpp_error 14 API calls 25683->25684 25685 92ca05 25684->25685 25686 922af0 std::_Throw_Cpp_error 14 API calls 25685->25686 25687 92ca18 25686->25687 25688 922af0 std::_Throw_Cpp_error 14 API calls 25687->25688 25689 92ca27 25688->25689 25689->25661 25690 92ca51 std::ios_base::_Ios_base_dtor 25689->25690 25692 922d88 25691->25692 25695 922d12 25691->25695 25784 922400 14 API calls 2 library calls 25692->25784 25694 922d17 std::locale::_Locimp::_Locimp 25694->25635 25695->25694 25770 922f50 25695->25770 25696 922d8d 25698 922d63 std::locale::_Locimp::_Locimp 25698->25635 25700 92c039 __fread_nolock 25699->25700 25700->25700 25701 922d00 std::_Throw_Cpp_error 14 API calls 25700->25701 25713 92c2e3 std::ios_base::_Ios_base_dtor 25700->25713 25702 92c0a6 25701->25702 25703 922d00 std::_Throw_Cpp_error 14 API calls 25702->25703 25704 92c0f5 25703->25704 25705 922d00 std::_Throw_Cpp_error 14 API calls 25704->25705 25706 92c138 25705->25706 25796 92b740 25706->25796 25708 92c219 GetVolumeInformationA 25709 92c2ad 25708->25709 25712 92c246 __fread_nolock 25708->25712 25827 9878c0 19 API calls 3 library calls 25709->25827 25712->25712 25825 923080 16 API calls 25712->25825 25713->25648 25714 92c311 25828 922400 14 API calls 2 library calls 25714->25828 25715 92c1b1 25721 98daa0 14 API calls 25715->25721 25716 92c2b9 25716->25713 25720 a01ea0 std::_Throw_Cpp_error 14 API calls 25716->25720 25719 92c289 25826 985330 14 API calls 3 library calls 25719->25826 25734 92c31b __Getctype 25720->25734 25722 92c1cc 25721->25722 25723 922af0 std::_Throw_Cpp_error 14 API calls 25722->25723 25724 92c1db 25723->25724 25727 922af0 std::_Throw_Cpp_error 14 API calls 25724->25727 25726 92c46a 25728 922af0 std::_Throw_Cpp_error 14 API calls 25726->25728 25727->25708 25729 92c47a 25728->25729 25729->25648 25730 92c461 25731 a0aec6 __freea 9 API calls 25730->25731 25731->25726 25732 92c45b 25830 a0aec6 25732->25830 25734->25726 25734->25730 25734->25732 25829 985330 14 API calls 3 library calls 25734->25829 25737 92bf85 25736->25737 25738 92bf5e 25736->25738 25855 92bd50 19 API calls ___std_exception_copy 25737->25855 25738->25652 25738->25653 25740->25639 25741->25646 25743 98dace 25742->25743 25744 98daf8 std::locale::_Locimp::_Locimp 25742->25744 25745 922f50 std::_Throw_Cpp_error 14 API calls 25743->25745 25744->25657 25745->25744 25747 98825f 25746->25747 25751 988232 std::locale::_Locimp::_Locimp 25746->25751 25748 98835d 25747->25748 25749 98826e 25747->25749 25856 922400 14 API calls 2 library calls 25748->25856 25752 922f50 std::_Throw_Cpp_error 14 API calls 25749->25752 25751->25660 25755 9882b4 std::locale::_Locimp::_Locimp 25752->25755 25753 a01ea0 std::_Throw_Cpp_error 14 API calls 25754 988367 std::ios_base::_Ios_base_dtor 25753->25754 25754->25660 25755->25753 25756 988314 std::ios_base::_Ios_base_dtor std::locale::_Locimp::_Locimp 25755->25756 25756->25660 25757->25664 25758->25666 25759->25668 25760->25670 25762 922b13 25761->25762 25763 922b2e std::ios_base::_Ios_base_dtor 25761->25763 25762->25763 25764 a01ea0 std::_Throw_Cpp_error 14 API calls 25762->25764 25763->25672 25765 922b5f 25764->25765 25766->25656 25857 a01ddc 14 API calls ___std_exception_copy 25767->25857 25769 a01eaf __Getctype 25771 922f62 25770->25771 25772 922f86 25770->25772 25773 922f69 25771->25773 25774 922f9f 25771->25774 25775 922f98 25772->25775 25776 9fc8a2 std::_Facet_Register 14 API calls 25772->25776 25785 9fc8a2 25773->25785 25793 9222f0 14 API calls 3 library calls 25774->25793 25775->25698 25779 922f90 25776->25779 25779->25698 25780 922f6f 25781 a01ea0 std::_Throw_Cpp_error 14 API calls 25780->25781 25782 922f78 25780->25782 25783 922fa9 25781->25783 25782->25698 25784->25696 25786 9fc8a7 ___std_exception_copy 25785->25786 25787 9fc8c1 25786->25787 25790 9222f0 Concurrency::cancel_current_task std::_Throw_Cpp_error 25786->25790 25795 a0ec3d RtlEnterCriticalSection RtlLeaveCriticalSection std::_Facet_Register 25786->25795 25787->25780 25789 9fc8cd 25789->25789 25790->25789 25794 9fdd45 14 API calls 2 library calls 25790->25794 25792 92234c 25792->25780 25793->25780 25794->25792 25795->25786 25818 92b7be std::ios_base::_Ios_base_dtor 25796->25818 25797 92b8ec 25798 92b931 25797->25798 25799 92b906 25797->25799 25802 92b92f 25798->25802 25803 92b940 25798->25803 25804 92b94d 25798->25804 25834 985030 14 API calls std::_Throw_Cpp_error 25799->25834 25800 92b984 25846 989120 14 API calls 25800->25846 25805 922af0 std::_Throw_Cpp_error 14 API calls 25802->25805 25836 9855d0 25803->25836 25845 993300 15 API calls 4 library calls 25804->25845 25811 92b961 25805->25811 25806 922d00 std::_Throw_Cpp_error 14 API calls 25806->25818 25807 92b917 25835 9842a0 14 API calls 25807->25835 25813 922af0 std::_Throw_Cpp_error 14 API calls 25811->25813 25815 92b96d 25813->25815 25814 92b923 25817 922af0 std::_Throw_Cpp_error 14 API calls 25814->25817 25815->25708 25815->25714 25815->25715 25817->25802 25818->25797 25818->25800 25818->25806 25819 92b97f 25818->25819 25833 993140 14 API calls 3 library calls 25818->25833 25822 a01ea0 std::_Throw_Cpp_error 14 API calls 25819->25822 25822->25800 25825->25719 25826->25709 25827->25716 25828->25716 25829->25732 25848 a14253 25830->25848 25833->25818 25834->25807 25835->25814 25837 9855f8 25836->25837 25838 98566c 25837->25838 25842 985602 25837->25842 25847 922400 14 API calls 2 library calls 25838->25847 25840 985607 25840->25802 25841 985671 25841->25802 25842->25840 25843 922f50 std::_Throw_Cpp_error 14 API calls 25842->25843 25844 98564a std::locale::_Locimp::_Locimp 25843->25844 25844->25802 25845->25802 25847->25841 25849 a1425e RtlFreeHeap 25848->25849 25853 a0aede 25848->25853 25850 a14273 GetLastError 25849->25850 25849->25853 25851 a14280 __dosmaperr 25850->25851 25854 a0a92f 9 API calls __dosmaperr 25851->25854 25853->25730 25854->25853 25855->25738 25856->25755 25857->25769 26441 93ab90 26442 93abd1 26441->26442 26443 922d00 std::_Throw_Cpp_error 14 API calls 26442->26443 26444 93abea 26443->26444 26445 922d00 std::_Throw_Cpp_error 14 API calls 26444->26445 26446 93ac17 26445->26446 26447 922d00 std::_Throw_Cpp_error 14 API calls 26446->26447 26448 93ac41 26447->26448 26449 93b492 26448->26449 26450 93ac52 26448->26450 26814 9854b0 14 API calls 26449->26814 26452 922d00 std::_Throw_Cpp_error 14 API calls 26450->26452 26453 93ac80 26452->26453 26456 9fc8a2 std::_Facet_Register 14 API calls 26453->26456 26454 93b25a 26457 93c7b9 26454->26457 26459 922d00 std::_Throw_Cpp_error 14 API calls 26454->26459 26455 9855d0 std::_Throw_Cpp_error 14 API calls 26466 93c81c 26455->26466 26458 93ac8e 26456->26458 26457->26455 26465 93cdf7 26457->26465 26460 9a1a30 25 API calls 26458->26460 26461 93b4dd 26459->26461 26462 93ac9f 26460->26462 26463 9fc8a2 std::_Facet_Register 14 API calls 26461->26463 26472 98b720 14 API calls 26462->26472 26464 93b4eb 26463->26464 26733 9a1a30 26464->26733 26468 93ce11 26465->26468 26474 93ce24 26465->26474 26471 9855d0 std::_Throw_Cpp_error 14 API calls 26466->26471 26871 9854b0 14 API calls 26468->26871 26469 93b4fc 26758 98b720 26469->26758 26501 93c85b 26471->26501 26473 93acd2 26472->26473 26476 922d00 std::_Throw_Cpp_error 14 API calls 26473->26476 26474->26474 26872 985330 14 API calls 3 library calls 26474->26872 26503 93ad01 26476->26503 26477 93cedb 26481 9855d0 std::_Throw_Cpp_error 14 API calls 26477->26481 26478 93b532 26488 922d00 std::_Throw_Cpp_error 14 API calls 26478->26488 26480 93cc43 26482 9855d0 std::_Throw_Cpp_error 14 API calls 26480->26482 26485 93ceef 26481->26485 26486 93cc53 26482->26486 26483 93c884 GetPEB 26483->26501 26484 93ce99 26484->26477 26874 985330 14 API calls 3 library calls 26484->26874 26489 9855d0 std::_Throw_Cpp_error 14 API calls 26485->26489 26490 922af0 std::_Throw_Cpp_error 14 API calls 26486->26490 26487 93ce22 26487->26484 26873 985330 14 API calls 3 library calls 26487->26873 26492 93b561 26488->26492 26493 93cf02 26489->26493 26494 93cc69 26490->26494 26766 989e70 26492->26766 26495 922af0 std::_Throw_Cpp_error 14 API calls 26493->26495 26496 93cddd 26494->26496 26865 98a630 35 API calls std::_Throw_Cpp_error 26494->26865 26498 93cf19 26495->26498 26500 922af0 std::_Throw_Cpp_error 14 API calls 26496->26500 26502 922af0 std::_Throw_Cpp_error 14 API calls 26498->26502 26500->26465 26501->26480 26501->26483 26505 93cf35 26502->26505 26506 922d00 std::_Throw_Cpp_error 14 API calls 26503->26506 26508 922af0 std::_Throw_Cpp_error 14 API calls 26505->26508 26509 93ad88 26506->26509 26513 93cf54 26508->26513 26515 9a2190 44 API calls 26509->26515 26514 93ccb6 26573 93cdb7 26514->26573 26866 98a190 14 API calls 2 library calls 26514->26866 26518 93ad9b 26515->26518 26516 93b98a 26521 922af0 std::_Throw_Cpp_error 14 API calls 26516->26521 26522 93af30 26518->26522 26798 98a630 35 API calls std::_Throw_Cpp_error 26518->26798 26520 93cd02 26867 98a2d0 14 API calls std::_Throw_Cpp_error 26520->26867 26528 93b999 26521->26528 26523 922af0 std::_Throw_Cpp_error 14 API calls 26522->26523 26534 93af3f 26523->26534 26526 93cd10 26531 922af0 std::_Throw_Cpp_error 14 API calls 26526->26531 26540 93cd27 26526->26540 26536 922d00 std::_Throw_Cpp_error 14 API calls 26528->26536 26563 93c000 26528->26563 26530 93b688 26657 93b95c 26530->26657 26816 98a190 14 API calls 2 library calls 26530->26816 26531->26540 26532 922af0 std::_Throw_Cpp_error 14 API calls 26541 93cd42 26532->26541 26533 93add9 26640 93af02 26533->26640 26799 98a190 14 API calls 2 library calls 26533->26799 26534->26454 26538 922d00 std::_Throw_Cpp_error 14 API calls 26534->26538 26539 93ba25 26536->26539 26542 93af9a 26538->26542 26543 9fc8a2 std::_Facet_Register 14 API calls 26539->26543 26540->26532 26868 98a190 14 API calls 2 library calls 26541->26868 26545 9fc8a2 std::_Facet_Register 14 API calls 26542->26545 26546 93ba33 26543->26546 26548 93afa8 26545->26548 26550 9a1a30 25 API calls 26546->26550 26547 93cd77 26869 98a2d0 14 API calls std::_Throw_Cpp_error 26547->26869 26553 9a1a30 25 API calls 26548->26553 26549 93b6c9 26549->26657 26817 98a190 14 API calls 2 library calls 26549->26817 26555 93ba44 26550->26555 26552 93ae12 26552->26640 26800 98a190 14 API calls 2 library calls 26552->26800 26558 93afb9 26553->26558 26568 98b720 14 API calls 26555->26568 26556 93cd85 26561 93cd9c 26556->26561 26565 922af0 std::_Throw_Cpp_error 14 API calls 26556->26565 26574 98b720 14 API calls 26558->26574 26559 93b6ff 26818 98a190 14 API calls 2 library calls 26559->26818 26560 922d00 std::_Throw_Cpp_error 14 API calls 26564 93c088 26560->26564 26567 922af0 std::_Throw_Cpp_error 14 API calls 26561->26567 26562 93ae40 26801 98a2d0 14 API calls std::_Throw_Cpp_error 26562->26801 26563->26457 26563->26560 26571 9fc8a2 std::_Facet_Register 14 API calls 26564->26571 26565->26561 26567->26573 26570 93ba77 26568->26570 26581 922d00 std::_Throw_Cpp_error 14 API calls 26570->26581 26576 93c096 26571->26576 26572 93ae4e 26802 9854e0 14 API calls std::_Throw_Cpp_error 26572->26802 26870 986ee0 14 API calls 2 library calls 26573->26870 26575 93afec 26574->26575 26584 922d00 std::_Throw_Cpp_error 14 API calls 26575->26584 26579 9a1a30 25 API calls 26576->26579 26578 93b80c 26823 98a190 14 API calls 2 library calls 26578->26823 26582 93c0a7 26579->26582 26580 93ae5e 26583 922af0 std::_Throw_Cpp_error 14 API calls 26580->26583 26586 93baa6 26581->26586 26592 98b720 14 API calls 26582->26592 26587 93ae6d 26583->26587 26604 93b01b 26584->26604 26585 93b754 26585->26578 26819 98a190 14 API calls 2 library calls 26585->26819 26594 989e70 14 API calls 26586->26594 26803 98a190 14 API calls 2 library calls 26587->26803 26590 93b864 26824 98a190 14 API calls 2 library calls 26590->26824 26591 93b78a 26820 98a190 14 API calls 2 library calls 26591->26820 26595 93c0dd 26592->26595 26596 93bb95 26594->26596 26602 922d00 std::_Throw_Cpp_error 14 API calls 26595->26602 26599 9a2190 44 API calls 26596->26599 26601 93bbab 26599->26601 26600 93b7df 26821 98a2d0 14 API calls std::_Throw_Cpp_error 26600->26821 26606 93bff1 26601->26606 26830 98a630 35 API calls std::_Throw_Cpp_error 26601->26830 26631 93c10c 26602->26631 26603 93aeab 26603->26640 26804 98a190 14 API calls 2 library calls 26603->26804 26609 922d00 std::_Throw_Cpp_error 14 API calls 26604->26609 26607 922af0 std::_Throw_Cpp_error 14 API calls 26606->26607 26607->26563 26613 93b13c 26609->26613 26610 93b7ed 26822 9854e0 14 API calls std::_Throw_Cpp_error 26610->26822 26612 93aed5 26805 98a2d0 14 API calls std::_Throw_Cpp_error 26612->26805 26617 9a2190 44 API calls 26613->26617 26614 93b8a4 26614->26657 26825 98a190 14 API calls 2 library calls 26614->26825 26623 93b14f 26617->26623 26619 93b7fd 26625 922af0 std::_Throw_Cpp_error 14 API calls 26619->26625 26620 93bfc3 26844 986ee0 14 API calls 2 library calls 26620->26844 26622 93aee3 26806 9854e0 14 API calls std::_Throw_Cpp_error 26622->26806 26628 93b24b 26623->26628 26808 98a630 35 API calls std::_Throw_Cpp_error 26623->26808 26624 93b8ef 26826 98a190 14 API calls 2 library calls 26624->26826 26625->26578 26626 93bbe9 26626->26620 26831 98a190 14 API calls 2 library calls 26626->26831 26632 922af0 std::_Throw_Cpp_error 14 API calls 26628->26632 26635 922d00 std::_Throw_Cpp_error 14 API calls 26631->26635 26632->26454 26633 93aef3 26636 922af0 std::_Throw_Cpp_error 14 API calls 26633->26636 26639 93c258 26635->26639 26636->26640 26637 93b21d 26813 986ee0 14 API calls 2 library calls 26637->26813 26638 93b92f 26827 98a2d0 14 API calls std::_Throw_Cpp_error 26638->26827 26643 9a2190 44 API calls 26639->26643 26807 986ee0 14 API calls 2 library calls 26640->26807 26647 93c26b 26643->26647 26644 93b18d 26644->26637 26809 98a190 14 API calls 2 library calls 26644->26809 26645 93b93d 26828 9854e0 14 API calls std::_Throw_Cpp_error 26645->26828 26646 93bc5b 26646->26620 26832 98a190 14 API calls 2 library calls 26646->26832 26651 93c7aa 26647->26651 26845 98a630 35 API calls std::_Throw_Cpp_error 26647->26845 26654 922af0 std::_Throw_Cpp_error 14 API calls 26651->26654 26652 93b94d 26656 922af0 std::_Throw_Cpp_error 14 API calls 26652->26656 26653 93bcc2 26833 98a190 14 API calls 2 library calls 26653->26833 26654->26457 26656->26657 26829 986ee0 14 API calls 2 library calls 26657->26829 26658 93c77c 26864 986ee0 14 API calls 2 library calls 26658->26864 26660 93b1c6 26660->26637 26810 98a190 14 API calls 2 library calls 26660->26810 26663 93c2a9 26663->26658 26846 98a190 14 API calls 2 library calls 26663->26846 26665 93b1f0 26811 98a2d0 14 API calls std::_Throw_Cpp_error 26665->26811 26666 93be38 26838 98a190 14 API calls 2 library calls 26666->26838 26668 93b1fe 26812 9854e0 14 API calls std::_Throw_Cpp_error 26668->26812 26669 93bd33 26669->26666 26834 98a190 14 API calls 2 library calls 26669->26834 26673 93bd9a 26835 98a190 14 API calls 2 library calls 26673->26835 26674 93c314 26674->26658 26847 98a190 14 API calls 2 library calls 26674->26847 26675 93b20e 26677 922af0 std::_Throw_Cpp_error 14 API calls 26675->26677 26676 93beaf 26839 98a190 14 API calls 2 library calls 26676->26839 26677->26637 26681 93be0b 26836 98a2d0 14 API calls std::_Throw_Cpp_error 26681->26836 26683 93c374 26683->26658 26848 98a190 14 API calls 2 library calls 26683->26848 26684 93be19 26837 9854e0 14 API calls std::_Throw_Cpp_error 26684->26837 26686 93beef 26686->26620 26840 98a190 14 API calls 2 library calls 26686->26840 26688 93c3d4 26849 98a190 14 API calls 2 library calls 26688->26849 26690 93be29 26692 922af0 std::_Throw_Cpp_error 14 API calls 26690->26692 26691 93bf56 26841 98a190 14 API calls 2 library calls 26691->26841 26692->26666 26695 93bf96 26842 98a2d0 14 API calls std::_Throw_Cpp_error 26695->26842 26696 93c430 26696->26658 26850 98a190 14 API calls 2 library calls 26696->26850 26699 93bfa4 26843 9854e0 14 API calls std::_Throw_Cpp_error 26699->26843 26700 93c490 26851 98a190 14 API calls 2 library calls 26700->26851 26702 93bfb4 26703 922af0 std::_Throw_Cpp_error 14 API calls 26702->26703 26703->26620 26705 93c4ec 26705->26658 26852 98a190 14 API calls 2 library calls 26705->26852 26707 93c537 26853 98a190 14 API calls 2 library calls 26707->26853 26709 93c57e 26854 98a190 14 API calls 2 library calls 26709->26854 26711 93c5a1 26711->26658 26855 98a190 14 API calls 2 library calls 26711->26855 26713 93c601 26856 98a190 14 API calls 2 library calls 26713->26856 26715 93c65d 26857 98a2d0 14 API calls std::_Throw_Cpp_error 26715->26857 26717 93c66b 26858 9854e0 14 API calls std::_Throw_Cpp_error 26717->26858 26719 93c67b 26720 922af0 std::_Throw_Cpp_error 14 API calls 26719->26720 26721 93c68a 26720->26721 26859 98a190 14 API calls 2 library calls 26721->26859 26723 93c6e5 26860 98a190 14 API calls 2 library calls 26723->26860 26725 93c72c 26861 98a190 14 API calls 2 library calls 26725->26861 26727 93c74f 26862 98a2d0 14 API calls std::_Throw_Cpp_error 26727->26862 26729 93c75d 26863 9854e0 14 API calls std::_Throw_Cpp_error 26729->26863 26731 93c76d 26732 922af0 std::_Throw_Cpp_error 14 API calls 26731->26732 26732->26658 26875 984ce0 14 API calls 3 library calls 26733->26875 26735 9a1ad8 26736 9a1d70 26735->26736 26737 9a1b0d GetModuleHandleA 26735->26737 26736->26469 26738 9a1b40 26737->26738 26738->26738 26739 9a1b4d GetProcAddress 26738->26739 26740 9a1b80 26739->26740 26740->26740 26741 9a1b8d GetProcAddress 26740->26741 26742 9a1bb8 26741->26742 26742->26742 26743 9a1bc5 GetProcAddress 26742->26743 26744 9a1bf0 26743->26744 26744->26744 26745 9a1bfd GetProcAddress 26744->26745 26746 9a1c32 26745->26746 26746->26746 26747 9a1c3f GetProcAddress 26746->26747 26748 9a1c63 26747->26748 26748->26748 26749 9a1c70 GetProcAddress 26748->26749 26750 9a1ca0 26749->26750 26750->26750 26751 9a1cad GetProcAddress 26750->26751 26752 9a1cd0 26751->26752 26752->26752 26753 9a1cdd GetProcAddress 26752->26753 26754 9a1d01 26753->26754 26754->26754 26755 9a1d0e GetProcAddress 26754->26755 26756 9a1d32 26755->26756 26756->26756 26757 9a1d3f GetProcAddress 26756->26757 26757->26469 26759 98b7b0 26758->26759 26763 98b732 26758->26763 26877 922400 14 API calls 2 library calls 26759->26877 26761 98b737 std::locale::_Locimp::_Locimp 26761->26478 26762 98b7b5 26763->26761 26876 9936a0 14 API calls 3 library calls 26763->26876 26765 98b787 std::locale::_Locimp::_Locimp 26765->26478 26767 989ea1 26766->26767 26767->26767 26768 989ebb 26767->26768 26769 989ef3 26767->26769 26771 98daa0 14 API calls 26768->26771 26878 922400 14 API calls 2 library calls 26769->26878 26773 93b634 26771->26773 26772 989ef8 26774 9a2190 26773->26774 26775 9a21fd 26774->26775 26776 9a22cf 26775->26776 26778 9855d0 std::_Throw_Cpp_error 14 API calls 26775->26778 26777 9a2301 std::ios_base::_Ios_base_dtor 26776->26777 26782 9a2358 26776->26782 26780 922af0 std::_Throw_Cpp_error 14 API calls 26777->26780 26779 9a224e 26778->26779 26781 9855d0 std::_Throw_Cpp_error 14 API calls 26779->26781 26783 9a2329 26780->26783 26785 9a2263 26781->26785 26784 a01ea0 std::_Throw_Cpp_error 14 API calls 26782->26784 26786 922af0 std::_Throw_Cpp_error 14 API calls 26783->26786 26787 9a235d 26784->26787 26879 9a2360 26785->26879 26789 9a2335 26786->26789 26969 987bc0 26789->26969 26791 93b64a 26791->26516 26815 98a630 35 API calls std::_Throw_Cpp_error 26791->26815 26794 9a22a6 26919 9a1d90 26794->26919 26798->26533 26799->26552 26800->26562 26801->26572 26802->26580 26803->26603 26804->26612 26805->26622 26806->26633 26807->26522 26808->26644 26809->26660 26810->26665 26811->26668 26812->26675 26813->26628 26814->26454 26815->26530 26816->26549 26817->26559 26818->26585 26819->26591 26820->26600 26821->26610 26822->26619 26823->26590 26824->26614 26825->26624 26826->26638 26827->26645 26828->26652 26829->26516 26830->26626 26831->26646 26832->26653 26833->26669 26834->26673 26835->26681 26836->26684 26837->26690 26838->26676 26839->26686 26840->26691 26841->26695 26842->26699 26843->26702 26844->26606 26845->26663 26846->26674 26847->26683 26848->26688 26849->26696 26850->26700 26851->26705 26852->26707 26853->26709 26854->26711 26855->26713 26856->26715 26857->26717 26858->26719 26859->26723 26860->26725 26861->26727 26862->26729 26863->26731 26864->26651 26865->26514 26866->26520 26867->26526 26868->26547 26869->26556 26870->26496 26871->26487 26872->26487 26873->26484 26874->26477 26875->26735 26876->26765 26877->26762 26878->26772 26880 9a238d 26879->26880 26885 9a2396 std::locale::_Locimp::_Locimp 26879->26885 26881 922af0 std::_Throw_Cpp_error 14 API calls 26880->26881 26882 9a26dd 26881->26882 26883 922af0 std::_Throw_Cpp_error 14 API calls 26882->26883 26884 9a2272 26883->26884 26884->26776 26910 984f80 26884->26910 26983 985330 14 API calls 3 library calls 26885->26983 26887 9a2558 26888 9a2587 26887->26888 26889 9a2570 26887->26889 26890 9a2701 26887->26890 26891 9a25d6 26888->26891 26895 9a2597 26888->26895 26984 985330 14 API calls 3 library calls 26889->26984 26988 989120 14 API calls 26890->26988 26892 9a25e0 26891->26892 26893 9a25d4 26891->26893 26985 985330 14 API calls 3 library calls 26892->26985 26986 9a2a10 43 API calls 2 library calls 26893->26986 26904 988210 std::_Throw_Cpp_error 14 API calls 26895->26904 26899 9a2706 26902 a01ea0 std::_Throw_Cpp_error 14 API calls 26899->26902 26900 9a2616 26987 9a2a10 43 API calls 2 library calls 26900->26987 26905 9a270b 26902->26905 26906 9a25bd 26904->26906 26907 988210 std::_Throw_Cpp_error 14 API calls 26906->26907 26907->26893 26908 9a26b5 std::ios_base::_Ios_base_dtor 26908->26880 26909 9a263d std::ios_base::_Ios_base_dtor 26909->26899 26909->26908 26911 984fa8 26910->26911 26912 985020 26911->26912 26915 984fb2 26911->26915 26990 922400 14 API calls 2 library calls 26912->26990 26913 984fb7 26913->26794 26915->26913 26989 9936a0 14 API calls 3 library calls 26915->26989 26916 985025 26918 984ffa std::locale::_Locimp::_Locimp 26918->26794 26922 9a1dc3 26919->26922 26920 987bc0 14 API calls 26921 9a1ee7 26920->26921 26921->26776 26927 9a1f00 26921->26927 26923 984f80 14 API calls 26922->26923 26926 9a1eb9 26922->26926 26924 9a1eaa 26923->26924 26991 9a2710 26924->26991 26926->26920 26928 9a1f26 26927->26928 27001 9a2860 26928->27001 26930 9a1f8f 26931 9a1fa3 26930->26931 26932 987bc0 14 API calls 26930->26932 26933 987bc0 14 API calls 26931->26933 26932->26931 26934 9a1fd3 26933->26934 26935 9a2004 26934->26935 27014 990c60 14 API calls std::_Throw_Cpp_error 26934->27014 26937 988210 std::_Throw_Cpp_error 14 API calls 26935->26937 26938 9a2042 26937->26938 26939 9a2070 std::ios_base::_Ios_base_dtor __fread_nolock 26938->26939 26940 9a2177 26938->26940 26942 9a2107 26939->26942 26951 988210 std::_Throw_Cpp_error 14 API calls 26939->26951 26941 a01ea0 std::_Throw_Cpp_error 14 API calls 26940->26941 26941->26942 26943 a01ea0 std::_Throw_Cpp_error 14 API calls 26942->26943 26944 9a2146 std::ios_base::_Ios_base_dtor 26942->26944 26945 9a2181 26943->26945 26944->26776 26946 9a22cf 26945->26946 26948 9855d0 std::_Throw_Cpp_error 14 API calls 26945->26948 26947 9a2301 std::ios_base::_Ios_base_dtor 26946->26947 26953 9a2358 26946->26953 26950 922af0 std::_Throw_Cpp_error 14 API calls 26947->26950 26949 9a224e 26948->26949 26952 9855d0 std::_Throw_Cpp_error 14 API calls 26949->26952 26954 9a2329 26950->26954 26951->26939 26956 9a2263 26952->26956 26955 a01ea0 std::_Throw_Cpp_error 14 API calls 26953->26955 26957 922af0 std::_Throw_Cpp_error 14 API calls 26954->26957 26958 9a235d 26955->26958 26959 9a2360 43 API calls 26956->26959 26960 9a2335 26957->26960 26963 9a2272 26959->26963 26961 987bc0 14 API calls 26960->26961 26962 9a2344 26961->26962 26962->26776 26963->26946 26964 984f80 14 API calls 26963->26964 26965 9a22a6 26964->26965 26966 9a1d90 14 API calls 26965->26966 26967 9a22b9 26966->26967 26967->26946 26968 9a1f00 44 API calls 26967->26968 26968->26946 26970 987be3 26969->26970 26971 987c04 std::ios_base::_Ios_base_dtor 26969->26971 26970->26971 26972 a01ea0 std::_Throw_Cpp_error 14 API calls 26970->26972 26971->26791 26973 987c37 26972->26973 26974 987c5f 26973->26974 26975 987dde 26973->26975 26976 987cbe 26973->26976 26974->26791 27017 922400 14 API calls 2 library calls 26975->27017 27016 9936a0 14 API calls 3 library calls 26976->27016 26978 a01ea0 std::_Throw_Cpp_error 14 API calls 26980 987de8 26978->26980 26981 987d09 std::locale::_Locimp::_Locimp 26981->26978 26982 987d84 std::ios_base::_Ios_base_dtor std::locale::_Locimp::_Locimp 26981->26982 26982->26791 26983->26887 26984->26888 26985->26893 26986->26900 26987->26909 26989->26918 26990->26916 26993 9a2744 26991->26993 26996 9a273c std::ios_base::_Ios_base_dtor 26991->26996 26992 987bc0 14 API calls 26994 9a2841 26992->26994 26995 988210 std::_Throw_Cpp_error 14 API calls 26993->26995 26993->26996 26994->26926 26997 9a2792 26995->26997 26996->26992 26997->26996 26998 9a2855 26997->26998 26999 a01ea0 std::_Throw_Cpp_error 14 API calls 26998->26999 27000 9a285a 26999->27000 27002 9a28af GetLastError 27001->27002 27003 9a288f 27001->27003 27007 9a28db 27002->27007 27008 9a29c8 27002->27008 27004 98b720 14 API calls 27003->27004 27006 9a28aa 27004->27006 27006->26930 27010 98b720 14 API calls 27007->27010 27009 98b720 14 API calls 27008->27009 27009->27006 27012 9a28fa 27010->27012 27011 9a2959 27011->26930 27012->27011 27015 984ce0 14 API calls 3 library calls 27012->27015 27014->26935 27015->27011 27016->26981 27017->26981 27039 936490 44 API calls 3 library calls 27040 934690 GetSystemTimePreciseAsFileTime __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __Xtime_get_ticks 27074 93e750 15 API calls std::_Throw_Cpp_error 25858 92ad80 25877 98a0a0 25858->25877 25864 922af0 std::_Throw_Cpp_error 14 API calls 25865 92ae76 25864->25865 25869 a06826 28 API calls 25870 92ae1c 25869->25870 25872 92ae2f 25870->25872 25897 9880a0 25870->25897 25908 a0b2cf 25872->25908 25876 92ae66 25876->25864 25878 9fc8a2 std::_Facet_Register 14 API calls 25877->25878 25879 98a0d5 25878->25879 25880 922d00 std::_Throw_Cpp_error 14 API calls 25879->25880 25881 92adbf 25880->25881 25882 a02a50 25881->25882 25917 a0298e 25882->25917 25885 a06826 25886 a06839 ___std_exception_copy 25885->25886 25971 a0657d 25886->25971 25891 a025db 25892 a025ee ___std_exception_copy 25891->25892 26049 a01ef1 25892->26049 25895 a01bcc ___std_exception_copy 14 API calls 25896 92ae10 25895->25896 25896->25869 25898 9880f1 25897->25898 25901 9880c2 __fread_nolock 25897->25901 25899 9881f6 25898->25899 25902 988100 25898->25902 26099 922400 14 API calls 2 library calls 25899->26099 25901->25872 25903 922f50 std::_Throw_Cpp_error 14 API calls 25902->25903 25906 988146 __fread_nolock std::locale::_Locimp::_Locimp 25903->25906 25904 a01ea0 std::_Throw_Cpp_error 14 API calls 25905 988200 25904->25905 25906->25904 25907 9881ad std::ios_base::_Ios_base_dtor __fread_nolock std::locale::_Locimp::_Locimp 25906->25907 25907->25872 26100 a0b2ec 25908->26100 25911 a062d8 25912 a062eb ___std_exception_copy 25911->25912 26232 a061b3 25912->26232 25914 a062f7 25915 a01bcc ___std_exception_copy 14 API calls 25914->25915 25916 a06303 25915->25916 25916->25876 25919 a0299a __fread_nolock 25917->25919 25918 a029a1 25942 a0a92f 9 API calls __dosmaperr 25918->25942 25919->25918 25921 a029c1 25919->25921 25923 a029d3 25921->25923 25924 a029c6 25921->25924 25922 a029a6 25943 a01e90 14 API calls ___std_exception_copy 25922->25943 25934 a13b28 25923->25934 25944 a0a92f 9 API calls __dosmaperr 25924->25944 25928 92adf6 25928->25876 25928->25885 25930 a029f0 25946 a02a2e RtlLeaveCriticalSection __fread_nolock 25930->25946 25931 a029e3 25945 a0a92f 9 API calls __dosmaperr 25931->25945 25935 a13b34 __fread_nolock 25934->25935 25947 a0d3ff RtlEnterCriticalSection 25935->25947 25937 a13b42 25948 a13bcc 25937->25948 25942->25922 25943->25928 25944->25928 25945->25928 25946->25928 25947->25937 25951 a13bef 25948->25951 25949 a13b4f 25962 a13b88 25949->25962 25950 a13c47 25967 a13893 9 API calls 3 library calls 25950->25967 25951->25949 25951->25950 25965 a0a480 RtlEnterCriticalSection 25951->25965 25966 a0a494 RtlLeaveCriticalSection 25951->25966 25954 a13c50 25955 a14253 __freea 9 API calls 25954->25955 25956 a13c59 25955->25956 25956->25949 25968 a14a2d GetLastError GetProcAddress std::locale::_Setgloballocale 25956->25968 25958 a13c78 25969 a0a480 RtlEnterCriticalSection 25958->25969 25961 a13c8b 25961->25949 25970 a0d447 RtlLeaveCriticalSection 25962->25970 25964 a029dc 25964->25930 25964->25931 25965->25951 25966->25951 25967->25954 25968->25958 25969->25961 25970->25964 25976 a06589 __fread_nolock 25971->25976 25972 a0658f 25998 a01e13 14 API calls 2 library calls 25972->25998 25974 a065d2 25988 a0a480 RtlEnterCriticalSection 25974->25988 25975 a065aa 25982 a01bcc 25975->25982 25976->25972 25976->25974 25978 a065de 25989 a06700 25978->25989 25980 a065f4 25999 a0661d RtlLeaveCriticalSection __fread_nolock 25980->25999 25983 a01bd8 25982->25983 25984 a01bef 25983->25984 26047 a01c77 14 API calls 2 library calls 25983->26047 25986 92ae0a 25984->25986 26048 a01c77 14 API calls 2 library calls 25984->26048 25986->25891 25988->25978 25990 a06713 25989->25990 25991 a06726 25989->25991 25990->25980 26000 a06627 25991->26000 25993 a06749 25997 a067d7 25993->25997 26004 a02cc1 25993->26004 25997->25980 25998->25975 25999->25975 26001 a06638 26000->26001 26003 a06690 26000->26003 26001->26003 26013 a0b82d 15 API calls 2 library calls 26001->26013 26003->25993 26005 a02d01 26004->26005 26006 a02cda 26004->26006 26010 a0b86d 26005->26010 26006->26005 26014 a13422 26006->26014 26008 a02cf6 26021 a1282c 26 API calls 2 library calls 26008->26021 26024 a0b74c 26010->26024 26012 a0b886 26012->25997 26013->26003 26015 a13443 26014->26015 26016 a1342e 26014->26016 26015->26008 26022 a0a92f 9 API calls __dosmaperr 26016->26022 26018 a13433 26023 a01e90 14 API calls ___std_exception_copy 26018->26023 26020 a1343e 26020->26008 26021->26005 26022->26018 26023->26020 26029 a17b7f 26024->26029 26026 a0b75e 26027 a0b766 __fread_nolock 26026->26027 26028 a0b792 GetLastError 26026->26028 26027->26012 26028->26027 26030 a17b8c 26029->26030 26032 a17ba1 26029->26032 26042 a0a91c 9 API calls __dosmaperr 26030->26042 26037 a17bc6 26032->26037 26044 a0a91c 9 API calls __dosmaperr 26032->26044 26034 a17b91 26043 a0a92f 9 API calls __dosmaperr 26034->26043 26035 a17bd1 26045 a0a92f 9 API calls __dosmaperr 26035->26045 26037->26026 26039 a17b99 26039->26026 26040 a17bd9 26046 a01e90 14 API calls ___std_exception_copy 26040->26046 26042->26034 26043->26039 26044->26035 26045->26040 26046->26039 26047->25984 26048->25986 26050 a01efd __fread_nolock 26049->26050 26051 a01f04 26050->26051 26052 a01f25 26050->26052 26064 a01e13 14 API calls 2 library calls 26051->26064 26060 a0a480 RtlEnterCriticalSection 26052->26060 26055 a01f1d 26055->25895 26056 a01f30 26061 a02000 26056->26061 26060->26056 26066 a02032 26061->26066 26063 a01f3f 26065 a01f67 RtlLeaveCriticalSection __fread_nolock 26063->26065 26064->26055 26065->26055 26067 a02041 26066->26067 26068 a02069 26066->26068 26082 a01e13 14 API calls 2 library calls 26067->26082 26070 a13422 __fread_nolock 14 API calls 26068->26070 26071 a02072 26070->26071 26079 a0b80f 26071->26079 26074 a0211c 26083 a0239e 17 API calls 3 library calls 26074->26083 26076 a02133 26078 a0205c __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 26076->26078 26084 a021d3 17 API calls 2 library calls 26076->26084 26078->26063 26085 a0b627 26079->26085 26082->26078 26083->26078 26084->26078 26086 a0b633 __fread_nolock 26085->26086 26087 a02090 26086->26087 26088 a0b676 26086->26088 26090 a0b6bc 26086->26090 26087->26074 26087->26076 26087->26078 26097 a01e13 14 API calls 2 library calls 26088->26097 26096 a17903 RtlEnterCriticalSection 26090->26096 26092 a0b6c2 26093 a0b6e3 26092->26093 26094 a0b74c __fread_nolock 15 API calls 26092->26094 26098 a0b744 RtlLeaveCriticalSection 26093->26098 26094->26093 26096->26092 26097->26087 26098->26087 26099->25906 26102 a0b2f8 __fread_nolock 26100->26102 26101 92ae60 26101->25911 26102->26101 26103 a0b342 26102->26103 26104 a0b30b __fread_nolock 26102->26104 26113 a0a480 RtlEnterCriticalSection 26103->26113 26127 a0a92f 9 API calls __dosmaperr 26104->26127 26106 a0b34c 26114 a0b0f6 26106->26114 26108 a0b325 26128 a01e90 14 API calls ___std_exception_copy 26108->26128 26113->26106 26116 a0b108 __fread_nolock 26114->26116 26121 a0b125 26114->26121 26115 a0b115 26189 a0a92f 9 API calls __dosmaperr 26115->26189 26116->26115 26119 a0b166 __fread_nolock 26116->26119 26116->26121 26120 a0b291 __fread_nolock 26119->26120 26119->26121 26123 a13422 __fread_nolock 14 API calls 26119->26123 26130 a11ac4 26119->26130 26191 a0611b 14 API calls 4 library calls 26119->26191 26192 a0a92f 9 API calls __dosmaperr 26120->26192 26129 a0b381 RtlLeaveCriticalSection __fread_nolock 26121->26129 26123->26119 26125 a0b11a 26190 a01e90 14 API calls ___std_exception_copy 26125->26190 26127->26108 26128->26101 26129->26101 26131 a11ad6 26130->26131 26132 a11aee 26130->26132 26209 a0a91c 9 API calls __dosmaperr 26131->26209 26133 a11e30 26132->26133 26137 a11b31 26132->26137 26224 a0a91c 9 API calls __dosmaperr 26133->26224 26136 a11adb 26210 a0a92f 9 API calls __dosmaperr 26136->26210 26140 a11b3c 26137->26140 26142 a11ae3 26137->26142 26148 a11b6c 26137->26148 26138 a11e35 26225 a0a92f 9 API calls __dosmaperr 26138->26225 26211 a0a91c 9 API calls __dosmaperr 26140->26211 26142->26119 26144 a11b49 26226 a01e90 14 API calls ___std_exception_copy 26144->26226 26145 a11b41 26212 a0a92f 9 API calls __dosmaperr 26145->26212 26149 a11b85 26148->26149 26150 a11bc0 26148->26150 26151 a11b92 26148->26151 26149->26151 26173 a11bae 26149->26173 26193 a142cd 26150->26193 26213 a0a91c 9 API calls __dosmaperr 26151->26213 26153 a11b97 26214 a0a92f 9 API calls __dosmaperr 26153->26214 26158 a11b9e 26215 a01e90 14 API calls ___std_exception_copy 26158->26215 26159 a14253 __freea 9 API calls 26161 a11bda 26159->26161 26162 a14253 __freea 9 API calls 26161->26162 26163 a11be1 26162->26163 26164 a11c06 26163->26164 26165 a11beb 26163->26165 26218 a0b82d 15 API calls 2 library calls 26164->26218 26216 a0a92f 9 API calls __dosmaperr 26165->26216 26167 a14253 __freea 9 API calls 26167->26142 26169 a11d0c 26171 a11d80 26169->26171 26174 a11d3c 26169->26174 26170 a11df8 GetLastError 26175 a11e05 26170->26175 26176 a11d5c 26170->26176 26171->26170 26177 a11d75 26171->26177 26172 a11bf0 26217 a0a91c 9 API calls __dosmaperr 26172->26217 26200 a1ce22 26173->26200 26174->26177 26182 a11d56 GetLastError 26174->26182 26222 a0a92f 9 API calls __dosmaperr 26175->26222 26188 a11ba9 __fread_nolock 26176->26188 26219 a0a8d5 9 API calls __dosmaperr 26176->26219 26184 a11dc1 26177->26184 26185 a11dd8 26177->26185 26177->26188 26181 a11e0a 26223 a0a91c 9 API calls __dosmaperr 26181->26223 26182->26176 26220 a117d6 16 API calls 2 library calls 26184->26220 26185->26188 26221 a1161c 15 API calls __fread_nolock 26185->26221 26188->26167 26189->26125 26190->26121 26191->26119 26192->26125 26194 a1430b 26193->26194 26199 a142db __Getctype 26193->26199 26228 a0a92f 9 API calls __dosmaperr 26194->26228 26196 a142f6 RtlAllocateHeap 26197 a11bd1 26196->26197 26196->26199 26197->26159 26199->26194 26199->26196 26227 a0ec3d RtlEnterCriticalSection RtlLeaveCriticalSection std::_Facet_Register 26199->26227 26201 a1ce2f 26200->26201 26203 a1ce3c 26200->26203 26229 a0a92f 9 API calls __dosmaperr 26201->26229 26206 a1ce48 26203->26206 26230 a0a92f 9 API calls __dosmaperr 26203->26230 26205 a1ce34 26205->26169 26206->26169 26207 a1ce69 26231 a01e90 14 API calls ___std_exception_copy 26207->26231 26209->26136 26210->26142 26211->26145 26212->26144 26213->26153 26214->26158 26215->26188 26216->26172 26217->26188 26218->26173 26219->26188 26220->26188 26221->26188 26222->26181 26223->26188 26224->26138 26225->26144 26226->26142 26227->26199 26228->26197 26229->26205 26230->26207 26231->26205 26233 a061bf __fread_nolock 26232->26233 26234 a061c9 26233->26234 26235 a061ec 26233->26235 26258 a01e13 14 API calls 2 library calls 26234->26258 26242 a061e4 26235->26242 26243 a0a480 RtlEnterCriticalSection 26235->26243 26238 a0620a 26244 a0624a 26238->26244 26240 a06217 26259 a06242 RtlLeaveCriticalSection __fread_nolock 26240->26259 26242->25914 26243->26238 26245 a06257 26244->26245 26246 a0627a 26244->26246 26271 a01e13 14 API calls 2 library calls 26245->26271 26248 a02cc1 26 API calls 26246->26248 26256 a06272 26246->26256 26249 a06292 26248->26249 26260 a1428d 26249->26260 26252 a13422 __fread_nolock 14 API calls 26253 a062a6 26252->26253 26264 a11ee0 26253->26264 26256->26240 26257 a14253 __freea 9 API calls 26257->26256 26258->26242 26259->26242 26261 a142a4 26260->26261 26262 a0629a 26260->26262 26261->26262 26263 a14253 __freea 9 API calls 26261->26263 26262->26252 26263->26262 26266 a11f09 26264->26266 26268 a062ad 26264->26268 26265 a11f58 26280 a01e13 14 API calls 2 library calls 26265->26280 26266->26265 26269 a11f30 26266->26269 26268->26256 26268->26257 26272 a11e4f 26269->26272 26271->26256 26273 a11e5b __fread_nolock 26272->26273 26281 a17903 RtlEnterCriticalSection 26273->26281 26275 a11e69 26276 a11e9a 26275->26276 26282 a11fb3 26275->26282 26295 a11ed4 RtlLeaveCriticalSection 26276->26295 26279 a11ebd 26279->26268 26280->26268 26281->26275 26283 a17b7f __fread_nolock 14 API calls 26282->26283 26286 a11fc3 26283->26286 26284 a11fc9 26296 a17aee 9 API calls __dosmaperr 26284->26296 26286->26284 26287 a17b7f __fread_nolock 14 API calls 26286->26287 26293 a11ffb 26286->26293 26289 a11ff2 26287->26289 26288 a17b7f __fread_nolock 14 API calls 26290 a12007 CloseHandle 26288->26290 26291 a17b7f __fread_nolock 14 API calls 26289->26291 26290->26284 26292 a12013 GetLastError 26290->26292 26291->26293 26292->26284 26293->26284 26293->26288 26294 a12021 __fread_nolock 26294->26276 26295->26279 26296->26294 27042 929280 19 API calls 2 library calls 27050 95c800 8 API calls 27077 9fbb42 6 API calls 3 library calls 27070 9fb4dd GetLastError 27071 a00500 9 API calls 4 library calls 27063 92b9f0 14 API calls 27024 93e7f0 27025 93e81e 27024->27025 27026 9855d0 std::_Throw_Cpp_error 14 API calls 27025->27026 27028 93e838 27026->27028 27027 93e872 27028->27027 27029 93e865 Sleep 27028->27029 27029->27027 27029->27029 27064 93e5f0 20 API calls std::_Throw_Cpp_error 27030 97d9f0 GetCursorPos 27031 97da10 GetCursorPos 27030->27031 27032 97daef GetPEB 27031->27032 27034 97da25 27031->27034 27032->27034 27033 97da33 GetPEB 27033->27034 27034->27032 27034->27033 27034->27034 27035 97db68 Sleep 27034->27035 27036 97daa8 Sleep GetCursorPos 27034->27036 27037 97db94 27034->27037 27035->27031 27036->27032 27036->27034 27051 970430 14 API calls std::_Throw_Cpp_error 27053 972d65 27051->27053 27052 9855d0 14 API calls std::_Throw_Cpp_error 27052->27053 27053->27051 27053->27052 27054 9229f0 14 API calls std::_Throw_Cpp_error 27053->27054 27054->27053 27073 98f330 15 API calls 2 library calls 26297 923be0 26298 923bf0 26297->26298 26299 923bf4 26297->26299 26300 922af0 14 API calls 26298->26300 26300->26299 26301 93e220 26302 93e5d8 26301->26302 26318 93e24a std::ios_base::_Ios_base_dtor __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 26301->26318 26303 93e293 setsockopt recv WSAGetLastError 26303->26302 26303->26318 26305 93e5c3 Sleep 26305->26302 26305->26318 26307 93e521 recv 26308 93e5bb Sleep 26307->26308 26308->26305 26309 9880a0 14 API calls 26310 93e339 recv 26309->26310 26311 93e35a recv 26310->26311 26310->26318 26311->26318 26312 93e5ea 26316 a01ea0 std::_Throw_Cpp_error 14 API calls 26312->26316 26313 9855d0 std::_Throw_Cpp_error 14 API calls 26313->26318 26314 93e3e2 setsockopt recv 26314->26318 26315 9880a0 14 API calls 26315->26314 26317 93e5ef 26316->26317 26318->26303 26318->26305 26318->26307 26318->26308 26318->26309 26318->26312 26318->26313 26318->26314 26318->26315 26320 93d430 WSAStartup 26318->26320 26329 93dc70 26318->26329 26408 9fc299 26318->26408 26321 93d536 26320->26321 26323 93d468 26320->26323 26321->26318 26322 93d530 WSACleanup 26322->26321 26323->26321 26323->26322 26324 93d4f4 socket 26323->26324 26328 93d526 26323->26328 26324->26322 26325 93d50a connect 26324->26325 26327 93d51c closesocket 26325->26327 26325->26328 26326 93d550 26326->26318 26327->26324 26327->26328 26328->26322 26328->26326 26330 93dcf9 26329->26330 26331 93dca9 26329->26331 26333 93dd01 26330->26333 26334 93dd18 26330->26334 26411 9229f0 26331->26411 26415 9854b0 14 API calls 26333->26415 26336 93dd20 26334->26336 26337 93dd37 26334->26337 26416 9854b0 14 API calls 26336->26416 26338 93dd58 26337->26338 26339 93dd3f 26337->26339 26341 93dd60 26338->26341 26342 93dd7e 26338->26342 26364 93dcbb 26339->26364 26417 9854b0 14 API calls 26339->26417 26418 a0a4e7 15 API calls ___std_exception_copy 26341->26418 26347 93e000 26342->26347 26348 93dd9e 26342->26348 26342->26364 26344 922af0 std::_Throw_Cpp_error 14 API calls 26346 93dce8 26344->26346 26346->26318 26349 93e05b 26347->26349 26350 93e008 26347->26350 26419 924f00 20 API calls std::_Throw_Cpp_error 26348->26419 26352 93e063 26349->26352 26353 93e0b6 26349->26353 26425 98a630 35 API calls std::_Throw_Cpp_error 26350->26425 26427 98a630 35 API calls std::_Throw_Cpp_error 26352->26427 26356 93e111 26353->26356 26357 93e0be 26353->26357 26361 93e119 26356->26361 26362 93e16c 26356->26362 26429 98a630 35 API calls std::_Throw_Cpp_error 26357->26429 26358 93e03a 26426 982cb0 14 API calls 26358->26426 26359 93e095 26428 982cb0 14 API calls 26359->26428 26431 98a630 35 API calls std::_Throw_Cpp_error 26361->26431 26366 93e1c7 26362->26366 26367 93e174 26362->26367 26364->26344 26365 9229f0 std::_Throw_Cpp_error 14 API calls 26383 93ddc0 26365->26383 26366->26364 26435 922880 15 API calls 2 library calls 26366->26435 26433 98a630 35 API calls std::_Throw_Cpp_error 26367->26433 26369 93e0f0 26430 982cb0 14 API calls 26369->26430 26373 93e14b 26432 982cb0 14 API calls 26373->26432 26375 93e1a6 26434 982cb0 14 API calls 26375->26434 26378 93e1de 26436 9854e0 14 API calls std::_Throw_Cpp_error 26378->26436 26381 93e1ed 26382 922af0 std::_Throw_Cpp_error 14 API calls 26381->26382 26382->26364 26383->26364 26383->26365 26384 922af0 14 API calls std::_Throw_Cpp_error 26383->26384 26385 93de78 26383->26385 26420 989f00 14 API calls 26383->26420 26384->26383 26421 922a30 14 API calls std::_Throw_Cpp_error 26385->26421 26387 93de96 26422 9346b0 15 API calls 3 library calls 26387->26422 26389 93dea4 26390 922af0 std::_Throw_Cpp_error 14 API calls 26389->26390 26391 93deb0 26390->26391 26392 93dedc 26391->26392 26393 93df09 26391->26393 26394 9855d0 std::_Throw_Cpp_error 14 API calls 26392->26394 26395 a02a50 16 API calls 26393->26395 26396 93def5 26394->26396 26397 93df36 26395->26397 26423 938bb0 16 API calls 3 library calls 26396->26423 26404 93df04 26397->26404 26424 a0a858 28 API calls ___std_exception_copy 26397->26424 26400 93df56 26403 a062d8 30 API calls 26400->26403 26401 93dfc1 26402 922af0 std::_Throw_Cpp_error 14 API calls 26401->26402 26405 93dfcf 26402->26405 26403->26404 26404->26401 26406 922af0 std::_Throw_Cpp_error 14 API calls 26404->26406 26407 922af0 std::_Throw_Cpp_error 14 API calls 26405->26407 26406->26404 26407->26364 26437 9fc84d 26408->26437 26412 922a13 26411->26412 26412->26412 26413 922d00 std::_Throw_Cpp_error 14 API calls 26412->26413 26414 922a25 26413->26414 26414->26364 26415->26364 26416->26364 26417->26364 26418->26364 26419->26383 26420->26383 26421->26387 26422->26389 26423->26404 26424->26400 26425->26358 26426->26364 26427->26359 26428->26364 26429->26369 26430->26364 26431->26373 26432->26364 26433->26375 26434->26364 26435->26378 26436->26381 26438 9fc87d GetSystemTimePreciseAsFileTime 26437->26438 26439 9fc2a7 26437->26439 26438->26439 26439->26318 27046 938ee0 20 API calls 2 library calls 27079 95fb60 20 API calls 4 library calls 27067 9a2fe0 10 API calls

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 0093AB90 Relevance: 184.2, Strings: 146, Instructions: 1711COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 0 93ab90-93ac4c call 922d90 call 922d00 call 922d90 call 922d00 call 922d90 call 922d00 13 93b492-93b49d call 9854b0 0->13 14 93ac52-93ad6b call 922d90 call 922d00 call 9fc8a2 call 9a1a30 call 922d90 call 98b720 call 922d90 call 922d00 call 982420 call 922d90 0->14 18 93b4a2-93b4a9 13->18 121 93ad70-93ad75 14->121 20 93c7d9-93c7e0 18->20 21 93b4af-93b64f call 922d90 call 922d00 call 9fc8a2 call 9a1a30 call 922d90 call 98b720 call 922d90 call 922d00 call 9819a0 call 989e70 call 9a2190 18->21 24 93c7e2-93c804 call 9822b0 call 9850c0 20->24 25 93c80a-93c871 call 9855d0 call 987df0 call 927d90 call 9855d0 call 93d840 20->25 145 93b655-93b696 call 98a630 21->145 146 93b98a-93b9c0 call 922af0 21->146 24->25 43 93ce08-93ce0f 24->43 77 93cc43-93cc81 call 9855d0 call 922af0 25->77 78 93c877-93c87e 25->78 47 93ce11-93ce22 call 9854b0 43->47 48 93ce24-93ce41 call 9822e0 43->48 62 93ce5c-93ce63 47->62 63 93ce44-93ce49 48->63 70 93ce65-93ce7a call 9822b0 62->70 71 93ce99-93cea0 62->71 63->63 68 93ce4b-93ce57 call 985330 63->68 68->62 87 93ce80-93ce85 70->87 73 93cea2-93cebf call 9822e0 71->73 74 93cedb-93cf7a call 9855d0 * 2 call 922af0 * 3 71->74 98 93cec2-93cec7 73->98 110 93cc87-93ccc4 call 98a630 77->110 111 93cddd-93ce04 call 922af0 77->111 78->77 86 93c884-93c88d GetPEB 78->86 93 93c890-93c8a4 86->93 87->87 96 93ce87-93ce94 call 985330 87->96 94 93c8f7-93c8f9 93->94 95 93c8a6-93c8ab 93->95 94->93 95->94 102 93c8ad-93c8b3 95->102 96->71 98->98 105 93cec9-93ced6 call 985330 98->105 112 93c8b5-93c8c7 102->112 105->74 130 93ccca-93cd1e call 9822e0 call 98a190 call 98a2d0 110->130 131 93cdc8-93cdd8 call 986ee0 110->131 111->43 119 93c8f0-93c8f5 112->119 120 93c8c9 112->120 119->94 119->112 126 93c8d0-93c8e2 120->126 121->121 127 93ad77-93ada0 call 922d00 call 9a2190 121->127 126->126 132 93c8e4-93c8ea 126->132 153 93af30-93af66 call 922af0 127->153 154 93ada6-93ade7 call 98a630 127->154 173 93cd33-93cd93 call 922af0 call 982310 call 98a190 call 98a2d0 130->173 174 93cd20-93cd2e call 922af0 call 922c90 130->174 131->111 132->119 137 93cc19-93cc3d 132->137 137->77 137->86 161 93b975-93b985 call 986ee0 145->161 162 93b69c-93b6cc call 982310 call 98a190 145->162 164 93b9c2-93b9c9 146->164 165 93b9f7-93bba6 call 922d90 call 922d00 call 9fc8a2 call 9a1a30 call 922d90 call 98b720 call 922d90 call 922d00 call 981910 call 989e70 call 9a2190 146->165 153->21 169 93af6c-93b121 call 922d90 call 922d00 call 9fc8a2 call 9a1a30 call 922d90 call 98b720 call 922d90 call 922d00 call 981cd0 call 922d90 153->169 167 93af1b-93af2b call 986ee0 154->167 168 93aded-93ae15 call 9822b0 call 98a190 154->168 161->146 162->161 202 93b6d2-93b757 call 982310 call 98a190 call 9822e0 call 98a190 162->202 164->165 175 93b9cb-93b9f1 call 9822b0 call 922940 164->175 313 93bbab-93bbb0 165->313 167->153 168->167 206 93ae1b-93aeae call 9822b0 call 98a190 call 98a2d0 call 9854e0 call 922af0 call 9822b0 call 98a190 168->206 310 93b124-93b129 169->310 232 93cd95-93cda3 call 922af0 call 922c90 173->232 233 93cda8-93cdc4 call 922af0 173->233 174->173 175->165 205 93c020-93c027 175->205 262 93b825-93b8a7 call 982310 call 98a190 call 982310 call 98a190 202->262 263 93b75d-93b821 call 982310 call 98a190 call 9822e0 call 98a190 call 98a2d0 call 9854e0 call 922af0 202->263 212 93c05a-93c23f call 922d90 call 922d00 call 9fc8a2 call 9a1a30 call 922d90 call 98b720 call 922d90 call 922d00 call 9818e0 call 922d90 205->212 213 93c029-93c030 205->213 206->167 303 93aeb0-93af17 call 9822b0 call 98a190 call 98a2d0 call 9854e0 call 922af0 206->303 352 93c240-93c245 212->352 213->212 220 93c032-93c054 call 9822b0 call 9850c0 213->220 220->20 220->212 232->233 233->131 262->161 317 93b8ad-93b971 call 982310 call 98a190 call 982310 call 98a190 call 98a2d0 call 9854e0 call 922af0 262->317 263->262 303->167 310->310 316 93b12b-93b154 call 922d00 call 9a2190 310->316 319 93bff1-93c019 call 922af0 313->319 320 93bbb6-93bbf7 call 98a630 313->320 354 93b24b-93b27a call 922af0 316->354 355 93b15a-93b19b call 98a630 316->355 317->161 319->205 341 93bbfd-93bc5e call 982150 call 98a190 320->341 342 93bfdc-93bfec call 986ee0 320->342 341->342 372 93bc64-93bd36 call 982150 call 98a190 call 982240 call 98a190 341->372 342->319 352->352 360 93c247-93c270 call 922d00 call 9a2190 352->360 354->18 369 93b1a1-93b1c9 call 9822b0 call 98a190 355->369 370 93b236-93b246 call 986ee0 355->370 387 93c276-93c2b7 call 98a630 360->387 388 93c7aa-93c7d2 call 922af0 360->388 369->370 394 93b1cb-93b232 call 9822b0 call 98a190 call 98a2d0 call 9854e0 call 922af0 369->394 370->354 413 93be51-93bef2 call 982150 call 98a190 call 982310 call 98a190 372->413 414 93bd3c-93be4d call 982150 call 98a190 call 982240 call 98a190 call 98a2d0 call 9854e0 call 922af0 372->414 402 93c795-93c7a5 call 986ee0 387->402 403 93c2bd-93c317 call 9822e0 call 98a190 387->403 388->20 394->370 402->388 403->402 419 93c31d-93c377 call 9822e0 call 98a190 403->419 413->342 445 93bef8-93bfd8 call 982150 call 98a190 call 982310 call 98a190 call 98a2d0 call 9854e0 call 922af0 413->445 414->413 419->402 441 93c37d-93c433 call 9822e0 call 98a190 call 982150 call 98a190 419->441 441->402 465 93c439-93c4ef call 9822e0 call 98a190 call 982150 call 98a190 441->465 445->342 465->402 482 93c4f5-93c5a4 call 982310 call 98a190 call 982510 call 98a190 call 9822b0 call 98a190 465->482 482->402 495 93c5aa-93c791 call 9822e0 call 98a190 call 982150 call 98a190 call 98a2d0 call 9854e0 call 922af0 call 982310 call 98a190 call 982510 call 98a190 call 9822b0 call 98a190 call 98a2d0 call 9854e0 call 922af0 482->495 495->402
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                  • String ID: $ $#$&$($)$*$+$+$,$-$.$/$1$1$2$2$3$5$5$6$7$>$@$@$@$A$COBUB$COBUB$Content-Type: application/x-www-form-urlencoded$D$D$D$D$D]@oR]WQ$D]@oR]WQ$D]@oR]WQ$D^$D^D^$E@J$F$F$H$H$H$H$I$IKB_x\U[$IKB_x\U[$IKB_x\U[$IKB_x\U[$IKB_x\U[$IO[Q$IO[Q$IO[Q$IO[Q$IO[Q$K$L$L$N$NAZ^$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@JwZRR$NAZ^E@JwZRR$NG[I$NG[I$NG[I$NG[I$NG[I$NG[I$NG[I$NMD^D^$NMNMD^D^$P$P$P$P$Q$R$S$S$S$S$T$T$U$U$V$V$W$X$X$X$X$Y$Y$Y$Z$Z$Z$Z$Z$Z$Z$Z$[$[$\$\$\$\$\KZD$]$]$]$]$]$^$^$^$^$^$^$^E]$c$h$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$k$m$m$n$v$v$w$x@D^$y${${
                                                                                                                                                                                                                                  • API String ID: 667068680-3885790087
                                                                                                                                                                                                                                  • Opcode ID: e19f1f88900ee41539a85fc9e349f3daf5413d94649fbd490a410fbc0c8b6307
                                                                                                                                                                                                                                  • Instruction ID: 05e5fab1f887c9877b150783eefa7f7c840b70d3acd25ec00ee93565ff182068
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e19f1f88900ee41539a85fc9e349f3daf5413d94649fbd490a410fbc0c8b6307
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0B133D709086E8D9EB22D768CD597DEBFB45F22304F0441D9D1897B282D7B90F88CB66
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0093E220 Relevance: 18.3, APIs: 12, Instructions: 260networksleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 528 93e220-93e244 529 93e24a 528->529 530 93e5d8-93e5e9 528->530 531 93e250-93e258 529->531 532 93e293-93e2dc setsockopt recv WSAGetLastError 531->532 533 93e25a-93e280 call 93d430 531->533 532->530 535 93e2e2-93e2e5 532->535 536 93e285-93e28d 533->536 537 93e536-93e55f call 9fc299 call a218a0 535->537 538 93e2eb-93e2f2 535->538 536->532 539 93e5c3-93e5d2 Sleep 536->539 543 93e5bb-93e5bd Sleep 537->543 551 93e561 537->551 541 93e521-93e531 recv 538->541 542 93e2f8-93e354 call 9880a0 recv 538->542 539->530 539->531 541->543 549 93e35a-93e375 recv 542->549 550 93e4cf-93e4dc 542->550 543->539 549->550 552 93e37b-93e3b6 549->552 553 93e50a-93e51c 550->553 554 93e4de-93e4ea 550->554 555 93e563-93e569 551->555 556 93e56b-93e5a3 call 93d840 551->556 557 93e429-93e477 call 9855d0 call 93d260 call 93dc70 552->557 558 93e3b8-93e3bd 552->558 553->543 559 93e500-93e507 call 9fcb23 554->559 560 93e4ec-93e4fa 554->560 555->543 555->556 569 93e5a8-93e5b6 556->569 577 93e47c-93e489 557->577 561 93e3d3-93e3dd call 9880a0 558->561 562 93e3bf-93e3d1 558->562 559->553 560->559 564 93e5ea-93e5ef call a01ea0 560->564 567 93e3e2-93e427 setsockopt recv 561->567 562->567 567->557 569->543 578 93e4b7-93e4cb 577->578 579 93e48b-93e497 577->579 578->550 580 93e499-93e4a7 579->580 581 93e4ad-93e4b4 call 9fcb23 579->581 580->564 580->581 581->578
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • setsockopt.WS2_32(0000032C,0000FFFF,00001006,?,00000008), ref: 0093E2B2
                                                                                                                                                                                                                                  • recv.WS2_32(?,00000004,00000002), ref: 0093E2CD
                                                                                                                                                                                                                                  • WSAGetLastError.WS2_32 ref: 0093E2D1
                                                                                                                                                                                                                                  • recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 0093E34F
                                                                                                                                                                                                                                  • recv.WS2_32(00000000,0000000C,00000008), ref: 0093E370
                                                                                                                                                                                                                                  • setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 0093E40C
                                                                                                                                                                                                                                  • recv.WS2_32(00000000,?,00000008), ref: 0093E427
                                                                                                                                                                                                                                    • Part of subcall function 0093D430: WSAStartup.WS2_32 ref: 0093D45A
                                                                                                                                                                                                                                    • Part of subcall function 0093D430: socket.WS2_32(?,?,?), ref: 0093D4FD
                                                                                                                                                                                                                                    • Part of subcall function 0093D430: connect.WS2_32(00000000,?,?), ref: 0093D511
                                                                                                                                                                                                                                    • Part of subcall function 0093D430: closesocket.WS2_32(00000000), ref: 0093D51D
                                                                                                                                                                                                                                    • Part of subcall function 0093D430: WSACleanup.WS2_32 ref: 0093D530
                                                                                                                                                                                                                                  • recv.WS2_32(?,00000004,00000008), ref: 0093E52F
                                                                                                                                                                                                                                  • __Xtime_get_ticks.LIBCPMT ref: 0093E536
                                                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0093E544
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 0093E5BD
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 0093E5C5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2144401278-0
                                                                                                                                                                                                                                  • Opcode ID: a09beed9371ee6992af72789a526455ca56e256ba7f3dd04d164e168eff12995
                                                                                                                                                                                                                                  • Instruction ID: ac39f46601a125439bd36f8b5a15413f57f57d8df52a274537c7add8fd34a1f4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a09beed9371ee6992af72789a526455ca56e256ba7f3dd04d164e168eff12995
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1BB18C70D00308DFDB10DBE8DD59BAEBBB5AF45304F208269E454AB2E2D7B45946CF81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092C490 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 416registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 584 92c490-92c4e0 call 92af30 587 92c4e2-92c4ed 584->587 587->587 588 92c4ef-92c50e 587->588 589 92c510-92c515 588->589 589->589 590 92c517-92c54c call 922d00 589->590 593 92c550-92c55b 590->593 593->593 594 92c55d-92c579 RegOpenKeyExA 593->594 595 92c606-92c61a 594->595 596 92c57f-92c5a4 594->596 597 92c620-92c62b 595->597 598 92c5a8-92c5b3 596->598 597->597 599 92c62d-92c64f 597->599 598->598 600 92c5b5-92c5d9 RegQueryValueExA 598->600 601 92c650-92c655 599->601 602 92c5db-92c5e1 600->602 603 92c5fd 600->603 601->601 604 92c657-92c68f call 922d00 call 9febe0 GetCurrentHwProfileA 601->604 605 92c5e4-92c5e9 602->605 603->595 612 92c691-92c69a 604->612 613 92c6bc-92c6db call 92bfc0 call 92bf20 604->613 605->605 607 92c5eb-92c5f8 call 985330 605->607 607->603 615 92c6a0-92c6a5 612->615 620 92c6e0-92c701 613->620 615->615 617 92c6a7-92c6b7 call 985330 615->617 617->613 621 92c704-92c709 620->621 621->621 622 92c70b-92c719 621->622 623 92ca7e call 922400 622->623 624 92c71f-92c84e call 98daa0 call 988210 call 989dd0 call 98d910 call 989dd0 call 98a040 call 922af0 * 3 622->624 627 92ca83 call a01ea0 623->627 649 92c850-92c85c 624->649 650 92c87c-92c93c call 922af0 * 3 624->650 631 92ca88-92ca8f call a01ea0 627->631 651 92c872-92c879 call 9fcb23 649->651 652 92c85e-92c86c 649->652 661 92c96b-92c96d 650->661 662 92c93e 650->662 651->650 652->627 652->651 664 92c993 661->664 665 92c96f-92c991 call 9fe4a0 661->665 663 92c943-92c960 call 9a3470 662->663 673 92c962-92c968 663->673 668 92c99d-92c9b1 call 9a32e0 664->668 665->668 674 92c9d2-92c9ef 668->674 675 92c9b3-92c9ce 668->675 673->661 676 92c9f0-92c9f5 674->676 675->674 676->676 677 92c9f7-92ca31 call 922d00 call 922af0 * 2 676->677 684 92ca33-92ca3f 677->684 685 92ca5b-92ca7d 677->685 686 92ca51-92ca58 call 9fcb23 684->686 687 92ca41-92ca4f 684->687 686->685 687->631 687->686
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000002,?,00000000,-00020019,00000000,?,?,?,x@D^^E],x@D^^E]), ref: 0092C571
                                                                                                                                                                                                                                  • RegQueryValueExA.KERNELBASE(00000000,`OLXX\Vs@_S,00000000,00020019,?,00000400,?,?,?,x@D^^E],x@D^^E]), ref: 0092C5D1
                                                                                                                                                                                                                                  • GetCurrentHwProfileA.ADVAPI32(?), ref: 0092C687
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentOpenProfileQueryValue
                                                                                                                                                                                                                                  • String ID: _$_$_$`OLXX\Vs@_S
                                                                                                                                                                                                                                  • API String ID: 3925990927-638885777
                                                                                                                                                                                                                                  • Opcode ID: 04bbbb6ad24707d3635685c4f4b6331768007ffd3a4f6468fa7673546bf440c7
                                                                                                                                                                                                                                  • Instruction ID: c5c872c445123a92a0b1c4690589c391b6dcd195fe22f780ae1ca1d941bd51fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04bbbb6ad24707d3635685c4f4b6331768007ffd3a4f6468fa7673546bf440c7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DD02F2B0C002A8DEDF15CFA8D844BEEBBB4AF55304F14429DE44977292DBB51B88CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0097D9F0 Relevance: 7.7, APIs: 5, Instructions: 159sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 690 97d9f0-97da09 GetCursorPos 691 97da10-97da1f GetCursorPos 690->691 692 97da25-97da2d 691->692 693 97daef-97dafb GetPEB 691->693 692->693 694 97da33-97da3f GetPEB 692->694 695 97db00-97db16 693->695 696 97da40-97da56 694->696 697 97db64-97db66 695->697 698 97db18-97db1d 695->698 700 97daa4-97daa6 696->700 701 97da58-97da5d 696->701 697->695 698->697 699 97db1f-97db25 698->699 702 97db27-97db3a 699->702 700->696 701->700 703 97da5f-97da65 701->703 704 97db5d-97db62 702->704 705 97db3c 702->705 706 97da67-97da7a 703->706 704->697 704->702 707 97db40-97db53 705->707 708 97da9d-97daa2 706->708 709 97da7c 706->709 707->707 710 97db55-97db5b 707->710 708->700 708->706 711 97da80-97da93 709->711 710->704 712 97db68-97db8f Sleep 710->712 711->711 713 97da95-97da9b 711->713 712->691 713->708 714 97daa8-97dadf Sleep GetCursorPos 713->714 714->693 715 97dae1-97dae9 714->715 715->693 716 97db94-97dba5 call 927d90 715->716 719 97dba7-97dba9 716->719 720 97dbab 716->720 721 97dbad-97dbca call 927d90 719->721 720->721
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCursorPos.USER32(?), ref: 0097DA07
                                                                                                                                                                                                                                  • GetCursorPos.USER32(?), ref: 0097DA15
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(000003E9,?,?,00000000,?,?,?,?,?,?,?,?,0097DDB8), ref: 0097DACA
                                                                                                                                                                                                                                  • GetCursorPos.USER32(?), ref: 0097DAD1
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(00000001,?,?,00000000,?,?,?,?,?,?,?,?,0097DDB8), ref: 0097DB87
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Cursor$Sleep
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1847515627-0
                                                                                                                                                                                                                                  • Opcode ID: 187aeafcd0f3291363b1e069ed991d10891bfbb5b533a6c8cb937413f7ebded3
                                                                                                                                                                                                                                  • Instruction ID: 220b82fd66b7f7ae7e4888e1792605eabca736ea38a83d771ac35e1b44c088fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 187aeafcd0f3291363b1e069ed991d10891bfbb5b533a6c8cb937413f7ebded3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D4518736609252CFC718CF18C4D0E6AB7F5FF89744F1A8999E4899B252D731ED09CB81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092BFC0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 382COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 985 92bfc0-92c050 call 9febe0 989 92c056-92c05f 985->989 990 92c2ff-92c310 985->990 991 92c063-92c06e 989->991 991->991 992 92c070-92c08f 991->992 993 92c090-92c095 992->993 993->993 994 92c097-92c0d9 call 922d00 993->994 997 92c0e0-92c0e5 994->997 997->997 998 92c0e7-92c11e call 922d00 997->998 1001 92c120-92c125 998->1001 1001->1001 1002 92c127-92c168 call 922d00 call 92b740 1001->1002 1007 92c219-92c244 GetVolumeInformationA 1002->1007 1008 92c16e-92c175 1002->1008 1009 92c246-92c263 call 9febe0 1007->1009 1010 92c2ad-92c2c3 call 9878c0 1007->1010 1011 92c177-92c182 1008->1011 1020 92c265-92c270 1009->1020 1018 92c2c5-92c2d1 1010->1018 1019 92c2ed-92c2fb 1010->1019 1011->1011 1014 92c184-92c195 1011->1014 1017 92c198-92c19d 1014->1017 1017->1017 1021 92c19f-92c1ab 1017->1021 1022 92c2e3-92c2ea call 9fcb23 1018->1022 1023 92c2d3-92c2e1 1018->1023 1019->990 1020->1020 1024 92c272-92c292 call 923080 1020->1024 1025 92c311 call 922400 1021->1025 1026 92c1b1-92c1b5 1021->1026 1022->1019 1023->1022 1027 92c316-92c3ba call a01ea0 1023->1027 1038 92c295-92c29a 1024->1038 1025->1027 1031 92c1b7 1026->1031 1032 92c1b9-92c214 call 98daa0 call 922af0 * 2 1026->1032 1045 92c3c0-92c3d0 call a027a0 1027->1045 1046 92c46e-92c48b call 922af0 1027->1046 1031->1032 1032->1007 1038->1038 1041 92c29c-92c2a8 call 985330 1038->1041 1041->1010 1052 92c3d6-92c3ec 1045->1052 1053 92c46d 1045->1053 1055 92c464-92c46a call a0aec6 1052->1055 1056 92c3ee-92c416 1052->1056 1053->1046 1055->1053 1056->1055 1060 92c418-92c427 call a027a0 1056->1060 1060->1055 1063 92c429-92c441 1060->1063 1065 92c443-92c445 1063->1065 1066 92c45b-92c461 call a0aec6 1063->1066 1067 92c448-92c44d 1065->1067 1066->1055 1067->1067 1069 92c44f-92c456 call 985330 1067->1069 1069->1066
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0092C23C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InformationVolume
                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                  • API String ID: 2039140958-336475711
                                                                                                                                                                                                                                  • Opcode ID: 67a1702747439391f7449ba18d431d70724b6afe975536da404e89fdbf3f6b0a
                                                                                                                                                                                                                                  • Instruction ID: 9a3dbe53c532e089a65e8993c5969ee8ce9e242d50c3d11a14efe9ca812c7053
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 67a1702747439391f7449ba18d431d70724b6afe975536da404e89fdbf3f6b0a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5FE1F2B0D00259EBDF14DFA4DC15BEEBBB8AF45304F14425DE410BB282D7B59A49CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0093D430 Relevance: 7.6, APIs: 5, Instructions: 92networkCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 724 93d430-93d462 WSAStartup 725 93d536-93d53f 724->725 726 93d468-93d492 call 927d90 * 2 724->726 731 93d494-93d498 726->731 732 93d49e-93d4e4 726->732 731->725 731->732 734 93d530 WSACleanup 732->734 735 93d4e6-93d4ec 732->735 734->725 736 93d544-93d54e 735->736 737 93d4ee 735->737 736->734 741 93d550-93d558 736->741 738 93d4f4-93d508 socket 737->738 738->734 740 93d50a-93d51a connect 738->740 742 93d540 740->742 743 93d51c-93d524 closesocket 740->743 742->736 743->738 744 93d526 743->744 744->734
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CleanupStartupclosesocketconnectsocket
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2410783842-0
                                                                                                                                                                                                                                  • Opcode ID: 8a2fe4e034f2fefa42580da7a6239566abb0b256a507f04fb353f6ae2f0fb3eb
                                                                                                                                                                                                                                  • Instruction ID: 3db4d9c096561f051e116e7a6e48f8d7bf489f2dbee64b8448e605c08661da13
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a2fe4e034f2fefa42580da7a6239566abb0b256a507f04fb353f6ae2f0fb3eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F731B0329057009FD7209F79EC4872AB7E9FF85778F140B1DF9A8961E0E371A8058A92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A11AC4 Relevance: 4.8, APIs: 3, Instructions: 292COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 874 a11ac4-a11ad4 875 a11ad6-a11ae9 call a0a91c call a0a92f 874->875 876 a11aee-a11af0 874->876 890 a11e48 875->890 877 a11e30-a11e3d call a0a91c call a0a92f 876->877 878 a11af6-a11afc 876->878 897 a11e43 call a01e90 877->897 878->877 880 a11b02-a11b2b 878->880 880->877 883 a11b31-a11b3a 880->883 886 a11b54-a11b56 883->886 887 a11b3c-a11b4f call a0a91c call a0a92f 883->887 893 a11e2c-a11e2e 886->893 894 a11b5c-a11b60 886->894 887->897 895 a11e4b-a11e4e 890->895 893->895 894->893 898 a11b66-a11b6a 894->898 897->890 898->887 901 a11b6c-a11b83 898->901 903 a11b85-a11b88 901->903 904 a11bb8-a11bbe 901->904 907 a11b8a-a11b90 903->907 908 a11bae-a11bb6 903->908 905 a11bc0-a11bc7 904->905 906 a11b92-a11ba9 call a0a91c call a0a92f call a01e90 904->906 911 a11bc9 905->911 912 a11bcb-a11bcc call a142cd 905->912 936 a11d63 906->936 907->906 907->908 910 a11c2b-a11c4a 908->910 914 a11c50-a11c5c 910->914 915 a11d06-a11d0f call a1ce22 910->915 911->912 920 a11bd1-a11be9 call a14253 * 2 912->920 914->915 919 a11c62-a11c64 914->919 926 a11d11-a11d23 915->926 927 a11d80 915->927 919->915 923 a11c6a-a11c8b 919->923 939 a11c06-a11c29 call a0b82d 920->939 940 a11beb-a11c01 call a0a92f call a0a91c 920->940 923->915 928 a11c8d-a11ca3 923->928 926->927 931 a11d25-a11d34 926->931 932 a11d84-a11d8f 927->932 928->915 933 a11ca5-a11ca7 928->933 931->927 948 a11d36-a11d3a 931->948 943 a11d98-a11d9a 932->943 933->915 937 a11ca9-a11ccc 933->937 941 a11d66-a11d70 call a14253 936->941 937->915 938 a11cce-a11ce4 937->938 938->915 944 a11ce6-a11ce8 938->944 939->910 940->936 941->895 949 a11df8-a11e03 GetLastError 943->949 950 a11d9c-a11da2 943->950 944->915 951 a11cea-a11d01 944->951 948->932 955 a11d3c-a11d54 948->955 956 a11e05-a11e17 call a0a92f call a0a91c 949->956 957 a11e1c-a11e1f 949->957 950->949 958 a11da4 950->958 951->915 970 a11d75-a11d7e 955->970 971 a11d56 GetLastError 955->971 956->936 959 a11e25-a11e27 957->959 960 a11d5c-a11d62 call a0a8d5 957->960 963 a11da7-a11db9 958->963 959->941 960->936 963->941 968 a11dbb-a11dbf 963->968 973 a11dc1-a11dd1 call a117d6 968->973 974 a11dd8-a11de5 968->974 970->963 971->960 982 a11dd4-a11dd6 973->982 976 a11df1-a11df6 call a1161c 974->976 977 a11de7 call a1192d 974->977 983 a11dec-a11def 976->983 977->983 982->941 983->982
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: ebaa32f66ae4ff3cc9ab612a7b66e4bfcf961ca76450f7bfa78385c009f6b4ac
                                                                                                                                                                                                                                  • Instruction ID: be8b69491e280cf73d662a4d08cdc388fd250ed90b8a34f73646b4f7b01ba5ee
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ebaa32f66ae4ff3cc9ab612a7b66e4bfcf961ca76450f7bfa78385c009f6b4ac
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 29B11374A04349AFDF11DFA8E881BFE7BB5AF45300F144158FA119B292C7709A82CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A14253 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1072 a14253-a1425c 1073 a1428b-a1428c 1072->1073 1074 a1425e-a14271 RtlFreeHeap 1072->1074 1074->1073 1075 a14273-a1428a GetLastError call a0a892 call a0a92f 1074->1075 1075->1073
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000000,00000000,?,00A1AD87,?,00000000,?,?,00A1B028,?,00000007,?,?,00A1B51C,?,?), ref: 00A14269
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00A1AD87,?,00000000,?,?,00A1B028,?,00000007,?,?,00A1B51C,?,?), ref: 00A14274
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                                  • Opcode ID: e727eb51a0f9ea03d9a35c716c54464418e64da76de43bcb15729cc3c9960ae8
                                                                                                                                                                                                                                  • Instruction ID: bf922001d3afd9ea2384db561b5f6d6a0a091318e1a33f8a5e0f754933426b5c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e727eb51a0f9ea03d9a35c716c54464418e64da76de43bcb15729cc3c9960ae8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B2E086325007246BCB116BF8BC087C93FA8AF04391F018464F60C86060D63489D18780
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A11FB3 Relevance: 2.6, APIs: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1080 a11fb3-a11fc7 call a17b7f 1083 a11fc9-a11fcb 1080->1083 1084 a11fcd-a11fd5 1080->1084 1085 a1201b-a1203b call a17aee 1083->1085 1086 a11fe0-a11fe3 1084->1086 1087 a11fd7-a11fde 1084->1087 1097 a1204d 1085->1097 1098 a1203d-a1204b call a0a8f8 1085->1098 1090 a12001-a12011 call a17b7f CloseHandle 1086->1090 1091 a11fe5-a11fe9 1086->1091 1087->1086 1089 a11feb-a11fff call a17b7f * 2 1087->1089 1089->1083 1089->1090 1090->1083 1100 a12013-a12019 GetLastError 1090->1100 1091->1089 1091->1090 1102 a1204f-a12052 1097->1102 1098->1102 1100->1085
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00A11E9A,00000000,CF830579,00A5DEE0,0000000C,00A11F56,00A062AD,?), ref: 00A12009
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00A11E9A,00000000,CF830579,00A5DEE0,0000000C,00A11F56,00A062AD,?), ref: 00A12013
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                                  • Opcode ID: 2463b59f0b51ed0ac85be72f04fd97ba695b4a3c92869d778a54276350b9176d
                                                                                                                                                                                                                                  • Instruction ID: db002f3093463a8fb1670931bc64be1525cb0c1d840f9ac0b5f32bcdef1fef1e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2463b59f0b51ed0ac85be72f04fd97ba695b4a3c92869d778a54276350b9176d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F112B3360C2541AD6246378AD45FFD67A98F96774F25021AFE198B1D2DF62CCC3C294
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A02032 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1105 a02032-a0203f 1106 a02041-a02064 call a01e13 1105->1106 1107 a02069-a0207d call a13422 1105->1107 1112 a021d0-a021d2 1106->1112 1113 a02082-a0208b call a0b80f 1107->1113 1114 a0207f 1107->1114 1116 a02090-a0209f 1113->1116 1114->1113 1117 a020a1 1116->1117 1118 a020af-a020b8 1116->1118 1119 a020a7-a020a9 1117->1119 1120 a02179-a0217e 1117->1120 1121 a020ba-a020c7 1118->1121 1122 a020cc-a02100 1118->1122 1119->1118 1119->1120 1123 a021ce-a021cf 1120->1123 1124 a021cc 1121->1124 1125 a02102-a0210c 1122->1125 1126 a0215d-a02169 1122->1126 1123->1112 1124->1123 1127 a02133-a0213f 1125->1127 1128 a0210e-a0211a 1125->1128 1129 a02180-a02183 1126->1129 1130 a0216b-a02172 1126->1130 1127->1129 1133 a02141-a0215b call a02549 1127->1133 1128->1127 1132 a0211c-a0212e call a0239e 1128->1132 1131 a02186-a0218e 1129->1131 1130->1120 1134 a02190-a02196 1131->1134 1135 a021ca 1131->1135 1132->1123 1133->1131 1138 a02198-a021ac call a021d3 1134->1138 1139 a021ae-a021b2 1134->1139 1135->1124 1138->1123 1143 a021b4-a021c2 call a218a0 1139->1143 1144 a021c5-a021c7 1139->1144 1143->1144 1144->1135
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 5fc1d20b441626b2ddd2f1a47d092f77e9100d6589d144dfd026fb1e34d601a4
                                                                                                                                                                                                                                  • Instruction ID: c465eeeb6660ea128288f27f6d18757e9091baafeefaf46736eb2fe4a1f1185a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5fc1d20b441626b2ddd2f1a47d092f77e9100d6589d144dfd026fb1e34d601a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3D519475A00308AFDF14CF58DD89BA97BB1EF89354F248259F9095B292D3719E81CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092AD80 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1148 92ad80-92adcf call 98a0a0 1151 92add0-92addb 1148->1151 1151->1151 1152 92addd-92adfd call a02a50 1151->1152 1155 92ae6a-92ae87 call 922af0 1152->1155 1156 92adff-92ae2d call a06826 call a025db call a06826 1152->1156 1165 92ae40-92ae47 call 9880a0 1156->1165 1166 92ae2f-92ae36 1156->1166 1170 92ae4c-92ae52 1165->1170 1167 92ae3a-92ae3e 1166->1167 1168 92ae38 1166->1168 1167->1170 1168->1167 1171 92ae56-92ae61 call a0b2cf call a062d8 1170->1171 1172 92ae54 1170->1172 1176 92ae66-92ae69 1171->1176 1172->1171 1176->1155
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __fread_nolock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2638373210-0
                                                                                                                                                                                                                                  • Opcode ID: deb57696c9ba650f9b5a4beb6f3064d9b4faa957771e8aee1552ab821c27589e
                                                                                                                                                                                                                                  • Instruction ID: 7dfad0085cb18a138c95de116657a333b4e455344dcc5c7860a190debbc55097
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: deb57696c9ba650f9b5a4beb6f3064d9b4faa957771e8aee1552ab821c27589e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E3107B1D00218EBDB10EF68D945B9F7BA8EF44704F104069F405AB2C2D7759A45CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00922F50 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1177 922f50-922f60 1178 922f62-922f67 1177->1178 1179 922f86-922f88 1177->1179 1180 922f69-922f6a call 9fc8a2 1178->1180 1181 922f9f call 9222f0 1178->1181 1182 922f8a-922f8b call 9fc8a2 1179->1182 1183 922f98-922f9e 1179->1183 1189 922f6f-922f76 1180->1189 1188 922fa4-922fa9 call a01ea0 1181->1188 1187 922f90-922f97 1182->1187 1189->1188 1191 922f78-922f85 1189->1191
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00922F9F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 25b642c66299ac68cff4bc7f2f50e1e33c888bb0f71e85d1c891a0fecb984a9e
                                                                                                                                                                                                                                  • Instruction ID: d00a986ec353c8251d5f26462473cf16c89034b2824cad6857ee4f809a63c889
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 25b642c66299ac68cff4bc7f2f50e1e33c888bb0f71e85d1c891a0fecb984a9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4F05972500119ABCB286F64FA015F9B3FCEF643A1350043AF88CC3246E726D8408780
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092BF20 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1193 92bf20-92bf5c SetupDiGetClassDevsA 1194 92bf85-92bf8f call 92bd50 1193->1194 1195 92bf5e-92bf83 1193->1195 1196 92bf92-92bfb0 1194->1196 1195->1196
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetupDiGetClassDevsA.SETUPAPI(00A35560,00000000,00000000), ref: 0092BF53
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ClassDevsSetup
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2330331845-0
                                                                                                                                                                                                                                  • Opcode ID: 0efea14964a4264880e0e6eccd2fa158e03998b3f7f56fbe4bdfb092003fb2e5
                                                                                                                                                                                                                                  • Instruction ID: b5c9760949ff18f11d3b2eede4e97466af671f0bbba46a381f77493b0f34fec6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0efea14964a4264880e0e6eccd2fa158e03998b3f7f56fbe4bdfb092003fb2e5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2401FCB0E04B54ABE320CF68E91579BBBF0FB00B24F100B1DE4555A6C0D3F92A448BC1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A142CD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1199 a142cd-a142d9 1200 a1430b-a14316 call a0a92f 1199->1200 1201 a142db-a142dd 1199->1201 1208 a14318-a1431a 1200->1208 1203 a142f6-a14307 RtlAllocateHeap 1201->1203 1204 a142df-a142e0 1201->1204 1205 a142e2-a142e9 call a11434 1203->1205 1206 a14309 1203->1206 1204->1203 1205->1200 1211 a142eb-a142f4 call a0ec3d 1205->1211 1206->1208 1211->1200 1211->1203
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,00A19713,4D88C033,?,00A19713,00000220,?,00A12C8F,4D88C033), ref: 00A142FF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                                                  • Opcode ID: 10cce7164d9d07ddf59d8ea0e350383c1ce80ab4548137a25b80e8d009df4c0c
                                                                                                                                                                                                                                  • Instruction ID: 2c0ca54a1111a41e4f127ce2f58057559e13fab10c9fc1f25ade5b95c11cbba3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 10cce7164d9d07ddf59d8ea0e350383c1ce80ab4548137a25b80e8d009df4c0c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4E0E53520422456D6316BBD9D00BDB3A58CF4A7A0F160120FD299B0C0CA60CCC186E4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A0B74C Relevance: 1.3, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,?,?,00A0B856,00000000,?,00000000,00000002,00A5DB98,00000000,00000000,00000000,00A5DB98,0000000C,00A0684E), ref: 00A0B795
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1452528299-0
                                                                                                                                                                                                                                  • Opcode ID: ee6cf128f9f40b1e89c3c683fec7b34c7304defbf14e83eccdf0bdb8c68ff77c
                                                                                                                                                                                                                                  • Instruction ID: ac7bca02cf4e087632a694cb5756d15ba83b6cb11c117fcde0a865876773a9df
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee6cf128f9f40b1e89c3c683fec7b34c7304defbf14e83eccdf0bdb8c68ff77c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5101D632624659AFCF05CF69ED45D9E3B29EFC5360B240208F8119B2E1E771DD52CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0093E9D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0093EA47
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                                                                                                  • Opcode ID: cd151c60e2c66f4f205668cc0478150b34b6552e8cebf1ce261384cafbe1674d
                                                                                                                                                                                                                                  • Instruction ID: f2e7bbf461607ec5c7c65f7177d8350a1c28df23a9507e034b2aacedff57949d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd151c60e2c66f4f205668cc0478150b34b6552e8cebf1ce261384cafbe1674d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4701F732A44794AFDB10EB9C9C02B2ABFB8E745B20F040659F4105B7D2D7F418418BD1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0093E7F0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0093E867
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                                                                                                  • Opcode ID: 835d4ba1b03d543400ad0f93d739b9611afeed1afd5e61de3eb420d75ef53d7f
                                                                                                                                                                                                                                  • Instruction ID: 49a2112f23bd198ac1846b0e3172444763846fa1e5572fffedd2623ae9ce79b6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 835d4ba1b03d543400ad0f93d739b9611afeed1afd5e61de3eb420d75ef53d7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F30126B2E04794EFDB20EBAC9C02B2A7BBAE785B20F040699F514177D1DBB42C0187C1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 0096C160 Relevance: 147.7, Strings: 116, Instructions: 2710COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: $ 6"$$$$$$$$$+-$$0c$$2&$($($)"6&$,$2'1d$<$<39;$@$AGJR$C$C]DG$C]^Q$EBU$EG^$E]gU$FSE$JMZ2$K$N[M`$N[M`$N[M`$N[M`$Obj3$R]AP$R]AP$T$TXVJ$VWYY$W$XG^$XPK$Xm@J$Y$ZAD]$[SC$\$\$\$\$\$\J^$\J^$\J^$\J^$\J^$\WcX$\[FY$\[FY$]VZ$]]]$^$^@W$^@Wd$^@Ww$^JqF$_[X$`OWD$akL%$bGAR$b\MY$b^JB$b^JBP$cGLX$cK[R$c_RO$cxft$d\FT$fABU$hJHU$hMZ2$hMZ2$hMZ2$iG\S$iG\S$iG\S$i\NW$lCFW$lZ@]$nA@G$nAB_$nALs$nFJT$nF]_$nF]_$nF]_$nF]_$nF]_\W$nF]_\]W[$nG[B$nKAD$n\V@$oO[D$o\NFT$qJFC$qJFCR]AP$qjFC$qlND$q}[U$rNZ2$s@\C$tOAT$x\N^$yA]S${GYQ$|WW]$}$~ZJQ$~^ZD
                                                                                                                                                                                                                                  • API String ID: 0-1655495799
                                                                                                                                                                                                                                  • Opcode ID: ad45886f7aa1deda3c40b454a1dff8b3eed75e1a008273cd6faf4037aee209b4
                                                                                                                                                                                                                                  • Instruction ID: eca4fe2da7b844c479827a96db5a15fcec8114320c068549c2671a345a658764
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ad45886f7aa1deda3c40b454a1dff8b3eed75e1a008273cd6faf4037aee209b4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6843AFB0C00269DACF15EF68D9157EEBBB4AF55304F0082C9E45827292DB751B8ACFD2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A1A30 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 241libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(7861677A,00000000,Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36,0000006F,00000000,?,?,?,?,?,?,00000000,00A336EC,000000FF), ref: 009A1B16
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1B5C
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1B96
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,zGAxEFCw), ref: 009A1BCE
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1C06
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1C48
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1C79
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1CB6
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1CE6
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1D17
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A1D48
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                  • String ID: $ESY$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$QZ[$zGAx$zGAxEFCw$zgax
                                                                                                                                                                                                                                  • API String ID: 667068680-2309192857
                                                                                                                                                                                                                                  • Opcode ID: 3156d5882a8f766167f7ec18adc5f6422aa1834ff33fd2175af27396dec090e8
                                                                                                                                                                                                                                  • Instruction ID: 64ec3fc6ead6fa87b03ee9932b70540d476088a61f2dcb5bbd3dbefb54b4afca
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3156d5882a8f766167f7ec18adc5f6422aa1834ff33fd2175af27396dec090e8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7B1B470C183898EDB05CFB8D9447EEBBF4EF1E308F14025EE485A6652E7B4528ACB55
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00938EE0 Relevance: 25.6, Strings: 19, Instructions: 1835COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: ,$,$.$.$4$@O][nQ\A[BEQ\I$@O][nV\YT_YK$IABQX\$IABQX\$IABQX\$IABQX\$RL[3$X\C$X\C$X\C$X\C$X\C$X\C$type must be boolean, but is
                                                                                                                                                                                                                                  • API String ID: 0-2996876817
                                                                                                                                                                                                                                  • Opcode ID: ce257c10aabee51c1aa6d9176164f018c7fd1632e58f6a1e8cd8eb0698cd995e
                                                                                                                                                                                                                                  • Instruction ID: 7bd007bd95555f0d656e607b3c2b83845797c8af8ac2780efb17b5668defb8d3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce257c10aabee51c1aa6d9176164f018c7fd1632e58f6a1e8cd8eb0698cd995e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B103FF708042988FDF25DF68C958BEEBBB4AF16304F0441C9E449AB292DB759F89CF51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00936490 Relevance: 23.9, APIs: 3, Strings: 10, Instructions: 1192fileregistryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 0092B1A0: GetLastError.KERNEL32(?,0097E8D7,?,00000000), ref: 0092B207
                                                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000), ref: 00936821
                                                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 0093689E
                                                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000), ref: 00936C88
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CopyFile$ErrorLastOpen
                                                                                                                                                                                                                                  • String ID: #!:;$/$7$B^J^$\$\$\$b^JBaKHQ$g$qwcy
                                                                                                                                                                                                                                  • API String ID: 1206503995-245990428
                                                                                                                                                                                                                                  • Opcode ID: 0cbb408f8b8ce566b98de0d3deec4786c2f2e9cd2b3722c0db90ed6cd0771c8d
                                                                                                                                                                                                                                  • Instruction ID: a20fecb1d7e3832a11718c8aafa7e924af52de01f5141cb6aedaed0a0771ebe8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0cbb408f8b8ce566b98de0d3deec4786c2f2e9cd2b3722c0db90ed6cd0771c8d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9FB2EF70C04298DBDF19CFA4C949BEDBBB1AF56304F24829CD0497B292D7755A88CFA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A2FE0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 169libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,d@[UC\V@zFRVx), ref: 009A302C
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A305D
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A308D
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A30BD
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A30ED
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,eZ[@d@[U), ref: 009A3128
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A3166
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A3196
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A31C6
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 009A31FB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                                                                                                  • String ID: d@[UC\V@zFRVx$eZ[@d@[U
                                                                                                                                                                                                                                  • API String ID: 190572456-3816776021
                                                                                                                                                                                                                                  • Opcode ID: a3e012be905efa7c4bca3e30f9d04b8753d28ff2f14f4f177ff8d706326f6413
                                                                                                                                                                                                                                  • Instruction ID: 8ecd9d670e85411ad806df9e8385b3c6bb518b7f8d5083e0882c14356a60a584
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3e012be905efa7c4bca3e30f9d04b8753d28ff2f14f4f177ff8d706326f6413
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A71DA7081828D99EB05CFE8D8057FEBBF8EF2E308F5541AED841A6122E774534AC765
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0095C800 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 163libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(5C5A4F5B,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0097FEF0), ref: 0095C845
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 0095C890
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?), ref: 0095C8CC
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32({OZ\EQ_]), ref: 0095C90B
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32({OZ\E}CQ[`VMUN), ref: 0095C94B
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?), ref: 0095C97E
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32({OZ\EuV@|BRU), ref: 0095C9BD
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32({OZ\EuV@|BRU), ref: 0095C9FC
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                  • String ID: XSL${OZ\EuV@|BRU${OZ\EuV@|BRU${OZ\E}CQ[`VMUN
                                                                                                                                                                                                                                  • API String ID: 2238633743-452386768
                                                                                                                                                                                                                                  • Opcode ID: bf1891d748e8bb7c35783156ad6e5fc4c35fe52c2e24d1e4fba29781f9bf278b
                                                                                                                                                                                                                                  • Instruction ID: 5f9e384ed9b2598af878b19cb6ded4030de145ca9468fea8276d6388fbfee32b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bf1891d748e8bb7c35783156ad6e5fc4c35fe52c2e24d1e4fba29781f9bf278b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0071E0B0818288DEDF05CFE9E8447EEBBF8EF0D305F1150AED805A6522D3B9464ACB55
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009294C0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 255memorylibraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(5C4B5A43,0000000F,0000006C,75919350), ref: 00929708
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00929713
                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32 ref: 00929720
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,00000000,00010000), ref: 00929736
                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,00000000,00010000), ref: 0092976C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • RLR!, xrefs: 009296A6
                                                                                                                                                                                                                                  • Y, xrefs: 009296E1
                                                                                                                                                                                                                                  • 5+,*, xrefs: 009296AD
                                                                                                                                                                                                                                  • CZK\, xrefs: 009296D3
                                                                                                                                                                                                                                  • #UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#U, xrefs: 009294F8
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$Alloc$AddressHandleModuleProcProcess
                                                                                                                                                                                                                                  • String ID: #UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#U$5+,*$CZK\$RLR!$Y
                                                                                                                                                                                                                                  • API String ID: 349456774-3045911204
                                                                                                                                                                                                                                  • Opcode ID: d3ff64f2e6936fc2628016b43dd8cf609d386d0f257ed733abf57409cbaec388
                                                                                                                                                                                                                                  • Instruction ID: ba6d4fd0df2ed59dfb56728a8dfffe90385520759f99641e134f401c49eb9d28
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3ff64f2e6936fc2628016b43dd8cf609d386d0f257ed733abf57409cbaec388
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33911671E00218AFDB14DFA8DC85BAEBBB9FF85314F144259F514AB2D1C7B19A01C790
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009360B0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 162libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(?,?), ref: 00936186
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00936191
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: D$EWcF$T^$ZURK$fK]^$n\JQ
                                                                                                                                                                                                                                  • API String ID: 1646373207-1569142387
                                                                                                                                                                                                                                  • Opcode ID: 40c6843a6d4d035c117117a2c6e4bad0197b820479e9d6391ef1b14cab5152d7
                                                                                                                                                                                                                                  • Instruction ID: cd380837092543df0130acd789671abec64e76fcf912db4303ec575455d27137
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40c6843a6d4d035c117117a2c6e4bad0197b820479e9d6391ef1b14cab5152d7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0351F070D04218EFDB14CFA8DC81BADBBB9FF49704F148159E505AB292D775A905CF80
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A1D9FE Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __floor_pentium4
                                                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                  • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                                  • Opcode ID: 37363dcbffb4402b6575edbbd9afacb279eadecb67f8c29fad340aa2d24b12f6
                                                                                                                                                                                                                                  • Instruction ID: 08d0c308bd071fc39d8f88357d13907f8f8d3705fdb2e4a711617e26968a380d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 37363dcbffb4402b6575edbbd9afacb279eadecb67f8c29fad340aa2d24b12f6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1CD21771E082298BDB65CF28DD407EAB7B5EB54345F1441EAD84EE7240E778AEC18F81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0095FB60 Relevance: 9.5, APIs: 1, Strings: 5, Instructions: 476COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 2=>9$483$Z$invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                                                  • API String ID: 0-13137305
                                                                                                                                                                                                                                  • Opcode ID: ee27b8831c51b9d53dbcb57450638cc48c6af95cc47135f0e7cd8353e3f332c0
                                                                                                                                                                                                                                  • Instruction ID: a0b6ff076d513d4b3502d8881113f97fcb3102261ceacad5926beaa29f3f822e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee27b8831c51b9d53dbcb57450638cc48c6af95cc47135f0e7cd8353e3f332c0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE020130D00258EFCB14DFA8C985BEEBBB4EF55300F148299E815B7291DB746A45CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A05B90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 3447c5f442cb295b333a382c0f0d2b2ed420420d43ef82b276c25580f959e04c
                                                                                                                                                                                                                                  • Instruction ID: a57d3f116d8f35112d3f05d43e027c34620cd02078284a7a58dfeeebbab3878d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3447c5f442cb295b333a382c0f0d2b2ed420420d43ef82b276c25580f959e04c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 31023B71E016199BDF14CFA9D9806AEFBF1FF48314F24826AE519A7380D731AA41CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009906C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: /Kim$/Kim$type must be number, but is $type must be string, but is
                                                                                                                                                                                                                                  • API String ID: 0-1144537432
                                                                                                                                                                                                                                  • Opcode ID: 5c66a0aa397112047b3ee3b4cd4f753881fc202794e9c18a3d57c6f454ecc50a
                                                                                                                                                                                                                                  • Instruction ID: 79a071b3b0d04d8d78bb854b6395ec61400d58c3b4289a5a7c78e9bb771a608e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c66a0aa397112047b3ee3b4cd4f753881fc202794e9c18a3d57c6f454ecc50a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F910776F002089FCB08DFACD8917AAB7A9EB89310F14827EE919D7395D6356D05CB80
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00991830 Relevance: 5.0, APIs: 3, Instructions: 526COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00991A43
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00991C0C
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00991DE1
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 7ca23b53fa42a2aff3156e49b02f487b2721c40acb3dbee13ae684ca87ec2d9f
                                                                                                                                                                                                                                  • Instruction ID: c4e44e98264d93834442878fe3d06ac78b0ae2d5bfbec087a1d30f8c8f3e49af
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7ca23b53fa42a2aff3156e49b02f487b2721c40acb3dbee13ae684ca87ec2d9f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC02A575E001199BCF08DFACDD91AADB7B9FB98350F148129E905E7395EB70AD01CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00992630 Relevance: 3.4, APIs: 2, Instructions: 392COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00992841
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00992AC5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: be6fb740d84a3ba6c86d806b1cb60298abb283356a5a06f08155b1f08085a5ea
                                                                                                                                                                                                                                  • Instruction ID: c5f78ecfcafb79b4990f2ccc17f7f33a3d2c8842763150dad272438e399c16d2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: be6fb740d84a3ba6c86d806b1cb60298abb283356a5a06f08155b1f08085a5ea
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7D1D672E001199BDF1CDFACDD91AADBBB9FB98700F144229E805AB395D770A901CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00938BB0 Relevance: 2.7, Strings: 2, Instructions: 236COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: %s|%s$:
                                                                                                                                                                                                                                  • API String ID: 0-1203899125
                                                                                                                                                                                                                                  • Opcode ID: 376e7717c6665f8fdd4cb62cfddb54b824dbd7298104f39b76711abc96b848e5
                                                                                                                                                                                                                                  • Instruction ID: f4b93498b79c05196347a1c75a0af837b82e1b4e1e70f7c397279c7b893a38f4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 376e7717c6665f8fdd4cb62cfddb54b824dbd7298104f39b76711abc96b848e5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1AA17771D00209AFDB14DFA8CC59BEEBBB4EF48300F208258F555AB2A1D7B56A45CF94
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A7270 Relevance: 2.0, Strings: 1, Instructions: 742COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: @?
                                                                                                                                                                                                                                  • API String ID: 0-130445511
                                                                                                                                                                                                                                  • Opcode ID: 88e00091ec8d38c85c3193e2c26ad8cff05939f879af9ed957889f58bdd8bd64
                                                                                                                                                                                                                                  • Instruction ID: fc6c2d6484214f0fe97ebcbe6abc32be24046181d39d56161c13a52b1ad9f6ae
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 88e00091ec8d38c85c3193e2c26ad8cff05939f879af9ed957889f58bdd8bd64
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E4627CB0E042059FDB14CF99C9856AEFBB5AF8A304F2481A9D814AB342DB75D946CFD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0096EB90 Relevance: 1.9, Strings: 1, Instructions: 609COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: qzGE_VVFW_E\
                                                                                                                                                                                                                                  • API String ID: 0-794482943
                                                                                                                                                                                                                                  • Opcode ID: 117bddf5ae5025e11e929e42915fcd6a00f3d5e7bc95362bfc261846c833a74e
                                                                                                                                                                                                                                  • Instruction ID: 38e4b14b2ba771f34417d263101e946f00ecf1b45b384c138b3ab7fd3b5b5c4c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 117bddf5ae5025e11e929e42915fcd6a00f3d5e7bc95362bfc261846c833a74e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B942C070C0428ACADF09DFA8D4157FEBBB1AF56308F14829DD4412B642E7B5938ACBD1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A0959F Relevance: 1.6, Strings: 1, Instructions: 333COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 0
                                                                                                                                                                                                                                  • API String ID: 0-4108050209
                                                                                                                                                                                                                                  • Opcode ID: 9f3b7b1fa1025e46abe0ae4194188e6b84b1adef04865e8f7afe902c56e9fbe7
                                                                                                                                                                                                                                  • Instruction ID: 91d79a8ac21b087d9d15f399f4c26ba9bf77acaf081c2f742a917fec1cf9b69a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f3b7b1fa1025e46abe0ae4194188e6b84b1adef04865e8f7afe902c56e9fbe7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89C1117090060E8FCB25CF68E994A7BBBB1EF46310F184619D496977D3D332AD49CB51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009FC84D Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetSystemTimePreciseAsFileTime.KERNEL32(?,?,00A33989,000000FF,?,009FC2A7,?,?,?,?,00934695,0097DC08), ref: 009FC885
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$FilePreciseSystem
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1802150274-0
                                                                                                                                                                                                                                  • Opcode ID: dcaeca99b0d5077b53342313795e91d5c256505c2603b627170b24fc2664d7ac
                                                                                                                                                                                                                                  • Instruction ID: 12747f24c1b268d550ae4d2aed792bb14ab16164622ce43c252a8baf9b8d9d6c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dcaeca99b0d5077b53342313795e91d5c256505c2603b627170b24fc2664d7ac
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CEF06572908A98EFCB05DF94ED00B69B7F8F708B50F10462AF91297790D7B5A9018BC0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3350A Relevance: 1.4, Strings: 1, Instructions: 186COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: NcYS
                                                                                                                                                                                                                                  • API String ID: 0-2298831672
                                                                                                                                                                                                                                  • Opcode ID: d8486636d88012920be0d8cee756f41acd21572d53660143f87650ec307b6278
                                                                                                                                                                                                                                  • Instruction ID: e64742b518551d4b2309c584d60478c8fa72393b1681cca475a341f369042c26
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8486636d88012920be0d8cee756f41acd21572d53660143f87650ec307b6278
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9751AAF3919614AFD3116E1DDC816AAFBE9EB99760F07493DEAD893700D6315800C6D2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C39555 Relevance: 1.4, Strings: 1, Instructions: 184COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: x};
                                                                                                                                                                                                                                  • API String ID: 0-4153400291
                                                                                                                                                                                                                                  • Opcode ID: 239658867882157f53a642f7c3475071819e2a7a5367a8cd1ae256e0225f3492
                                                                                                                                                                                                                                  • Instruction ID: cc731a3ec8a2c2fecf7920dbac912ab967eceeed90d9bc2ccfc000b3d927af03
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 239658867882157f53a642f7c3475071819e2a7a5367a8cd1ae256e0225f3492
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1851E6F360C7149FE3056F29EC8567AFBE9EB84221F16493DEAC4D3704E971580086D6
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00922400 Relevance: 1.4, Strings: 1, Instructions: 160COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::invalid_argument::invalid_argument
                                                                                                                                                                                                                                  • String ID: string too long
                                                                                                                                                                                                                                  • API String ID: 2141394445-2556327735
                                                                                                                                                                                                                                  • Opcode ID: d48187648caf7a92e105ef3e173f5bc138ee737214a121e300cd4774b9bbffd7
                                                                                                                                                                                                                                  • Instruction ID: 83fb5b61a43b1cbd909390b4cb936f41e15c533b8ba1865e1a5d9a2f5a7fcb7e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d48187648caf7a92e105ef3e173f5bc138ee737214a121e300cd4774b9bbffd7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04511671D042A9AFEB019FA8D4257EFBFF8EF56300F044159E9946B382C6748605C7E0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A3470 Relevance: .8, Instructions: 763COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
                                                                                                                                                                                                                                  • Instruction ID: 38df03d7bd016f61da28163d78929a9c0fd1f62e942d5819aff4dbde8d3ecf32
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EE3273B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0099F360 Relevance: .4, Instructions: 394COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: f5c5b533877cf3ec9005cc5efc7db13f0e9db28ca10cccb926657bc7928d88d3
                                                                                                                                                                                                                                  • Instruction ID: 08f4ecc43753d1d95f9ed47a51cd6c6fa14e9b0089a3bfd4f13e65bcd59db10f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f5c5b533877cf3ec9005cc5efc7db13f0e9db28ca10cccb926657bc7928d88d3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9CE10376E1122A8FCF05CFA8D4916ADFBF5BF88360F1941A9D814F7340D670A945CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A1B84F Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1452528299-0
                                                                                                                                                                                                                                  • Opcode ID: 1bea6b6843ddff56c8477510d46a937d11f8b2f090043eb60cedc312df94c053
                                                                                                                                                                                                                                  • Instruction ID: f6a8bb83eedb7ace737dc64973134fad8441e8963952dbf24571d74c43fdbcfe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1bea6b6843ddff56c8477510d46a937d11f8b2f090043eb60cedc312df94c053
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42B1E3756107059BDB389F29CC82AF7B3A8EF44308F54456DEA87C6580EB75A9C6CB20
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A16CC5 Relevance: .3, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 6349a100b4ef571bc2081e19f415a499a59c622e4fe10e087e12929c0e425e22
                                                                                                                                                                                                                                  • Instruction ID: cc152bcb4430df53c6a58c43ccff29893adbf23cba95dd50a221ff6bddefe581
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6349a100b4ef571bc2081e19f415a499a59c622e4fe10e087e12929c0e425e22
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4B13B366106089FD715CF28D48ABA57BE1FF45364F29865CE89ACF2E1C335E992CB40
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00922600 Relevance: .2, Instructions: 221COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: be4510e863882f7dccf514bb7c5be91fe734486da7bfbf237bc1a37814ffdd53
                                                                                                                                                                                                                                  • Instruction ID: b25ba69ec4cd51e1c294d2fbc9ecff1ebc657f6a350ac4677985f7d940f5f7b5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: be4510e863882f7dccf514bb7c5be91fe734486da7bfbf237bc1a37814ffdd53
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D8103B5D04266AFDB10CF68E8D07FEBBF9EB1A300F140169E85497742C735990AC7A0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3242B Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 2ab25dcf211e0baf4c5347a5cd2fe1c84a8822896b50847e1fdbfc3b9f13b3e4
                                                                                                                                                                                                                                  • Instruction ID: 20b08072f64a8c3dff631c83ad7fe46aa8f9acf5b1c17c45a45c5022ec09845d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2ab25dcf211e0baf4c5347a5cd2fe1c84a8822896b50847e1fdbfc3b9f13b3e4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6C511AF351C604AFE300AE2DDC8166BF7E9EF94260F16492DEAC4C3700E67598118A93
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A3EF0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 484c3fd27a92b853095d332d7e6b03897d5c21b1da4e449f6a480c4efe8d0770
                                                                                                                                                                                                                                  • Instruction ID: adeb264dd10cac715c80cd8d44f65d32e4bec8e166ad4ba78d55c796d60d2b4e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 484c3fd27a92b853095d332d7e6b03897d5c21b1da4e449f6a480c4efe8d0770
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 91615575A301655FDB18CF5EECC44663362A39A3013C5822AFB81C73A5C635E527DBE0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C34077 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 9a2cea897582e4add8e07add5e2e9fb0a93a8b8c5e4d40dace0b3eff7ee0d8b0
                                                                                                                                                                                                                                  • Instruction ID: ecb68148a96581416e72ee2f969f13f892ec84dc36ae1c3dacadb0b78625a7f8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a2cea897582e4add8e07add5e2e9fb0a93a8b8c5e4d40dace0b3eff7ee0d8b0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5451B5B360C604AFE7017E2AEC456BAFBE5EFD4720F16893DE6C483704EA3194058697
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C32360 Relevance: .2, Instructions: 181COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: fca71e06afdb9973d7445c6445df090fdbe66eaa8bd6e2f1668577cb8a112bbb
                                                                                                                                                                                                                                  • Instruction ID: 494dc81772b6b577ef7ae83253897f5a71d821122f72ae06df65d6eb9f038ad1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fca71e06afdb9973d7445c6445df090fdbe66eaa8bd6e2f1668577cb8a112bbb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B510BF250C204AFE715AE1DEC81BBEFBE9EB84724F05892DFBC583B44D53958018696
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3A1DF Relevance: .2, Instructions: 177COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: dd1c0aaa0c50a96b52ca92fc40740191edf8038172b867f09e791cc2c491aa8c
                                                                                                                                                                                                                                  • Instruction ID: 982b76a8e4d50028be753e45eb3f01207f7f540d51abb172d48af825f37429f1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd1c0aaa0c50a96b52ca92fc40740191edf8038172b867f09e791cc2c491aa8c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F51AFB361C6149FE7056F1DEC866AAF7E5EF98320F06092DE6C487740EA31A80087D7
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C32B8B Relevance: .2, Instructions: 169COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: f4d1ef90f498adcc063fa92aef94b366ec2a70202868b1bf984bab08e518a98d
                                                                                                                                                                                                                                  • Instruction ID: bd682e4a0ed7df7c7fa361cd3f50696ebf9b7083cd8abdc6a9ae74bb3f06af4d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4d1ef90f498adcc063fa92aef94b366ec2a70202868b1bf984bab08e518a98d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5E5108B251C704AFE305BE19DC456BEFBE5EFD8320F16892EE6C483700E63555018A97
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3186E Relevance: .2, Instructions: 166COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: a336ab78a49fe11848555b99bd0d1787cbc0a649ef883608206f68aa923da74b
                                                                                                                                                                                                                                  • Instruction ID: 36e42975f84be3b2582e733dc18b09119932bcd8276fe486b5a3040225743299
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a336ab78a49fe11848555b99bd0d1787cbc0a649ef883608206f68aa923da74b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0151A3B351C6049FE315AE2DDC817BAB7E6EFD8320F16492DE7D483744DA3554008A9B
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009346B0 Relevance: .2, Instructions: 166COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 889c1f34cac5bea4961b895c1da467ca1934b141629168dc244a457fe34cf3b9
                                                                                                                                                                                                                                  • Instruction ID: 5b46d8c7d3f68d3b2db7e3e980451e9656d471dbe3f086c483ab3372c9a0537c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 889c1f34cac5bea4961b895c1da467ca1934b141629168dc244a457fe34cf3b9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC51BEB1E002199FDB04CFA8D955BEEBBB9FF48304F154259E411B7380D779AA048FA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C39751 Relevance: .2, Instructions: 162COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 5087cc7d7e1f58862d5cc81e2c053687217a31f61b4bdad07a1c50c905bc2ee1
                                                                                                                                                                                                                                  • Instruction ID: 77bbcf54747be92a772f36602fffe013a1e263accf1924c380cdfd00d3be7b9e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5087cc7d7e1f58862d5cc81e2c053687217a31f61b4bdad07a1c50c905bc2ee1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CB5165B36082149FE3156F19EC81B7EF7E5EB98720F06492DEBD593740D63158048697
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3328E Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 02f87813cb298412c346287fc46ffc1e8e49c39c6f8dd3d300b8d948f24fec54
                                                                                                                                                                                                                                  • Instruction ID: 325ce5410d1c6bdb37e9ae685eedeeb47221dbf828660a973a5dd29377dd4f1c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 02f87813cb298412c346287fc46ffc1e8e49c39c6f8dd3d300b8d948f24fec54
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB416EF260C604AFE714AF19EC8177ABBE4EB94720F02492EE6C993740E6355404C697
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C3B49D Relevance: .2, Instructions: 157COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: cc1037745fd295e6b4430a17b2a04d159509cb6ec0d9732b9364da7e6f63aa9b
                                                                                                                                                                                                                                  • Instruction ID: f2c0a313f5124f989583ac014c15488d8a476ed6a5e3ae061cdb3188a360fa68
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc1037745fd295e6b4430a17b2a04d159509cb6ec0d9732b9364da7e6f63aa9b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7C515EB250C600AFE351AF59ECC1B7AB7E5EF98310F06892DEAD4C7750E63598108B97
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C35FB7 Relevance: .2, Instructions: 157COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e62d45157482ae09255404c90b60dcdd3411e751ddbfff6a8599c4f24b62e4d6
                                                                                                                                                                                                                                  • Instruction ID: a29ddaf7cb7866004bd33112c4f68227fa484d1443eea68a037134511dae2532
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e62d45157482ae09255404c90b60dcdd3411e751ddbfff6a8599c4f24b62e4d6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D4416CB260C600AFE305AE19DD81BBAF7E5EFD8320F06892DE7C483740D63558408A96
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A03B58 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 40a7e029f2f3b1f88d2cfe11b170cc748dba17dd9b913f792cc9312304564770
                                                                                                                                                                                                                                  • Instruction ID: b1a5b98dbfab6e6f3e79c64b36572cf0cf78fe829bd57a720faa3a9895b8d52c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40a7e029f2f3b1f88d2cfe11b170cc748dba17dd9b913f792cc9312304564770
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09519172D00219EFDF04CF99D840AEEBBB6FF88304F098469E515AB241D7349A50CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C34A5A Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 21666dd42c1eaabc7061a68ce2beba2120c5cb27cd8d96059dc9550a623d0ac6
                                                                                                                                                                                                                                  • Instruction ID: 7915f3e04d405e75637468498db212807659a3f64bfd343387eeb87da3fb2095
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 21666dd42c1eaabc7061a68ce2beba2120c5cb27cd8d96059dc9550a623d0ac6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 414182B250C500AFE315AF19EC416BABBE5EF98320F06493DE6C8D3750E63558108A97
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C39D89 Relevance: .1, Instructions: 148COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: cd28aa655a4dd014b91dedd56867e2fc8de2e421a73de99736512641329884e5
                                                                                                                                                                                                                                  • Instruction ID: dcf8381cb0e564538cb456c55c240a8c0c45708391e4f0bacd9aa374be65dc01
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd28aa655a4dd014b91dedd56867e2fc8de2e421a73de99736512641329884e5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4D416CF250C2049FE314BF69EC85B7ABBE5EB58310F06492DEAD483340E6356554CA9B
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00C322E8 Relevance: .1, Instructions: 141COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 3608daf4efc6c9f0c03ce24313c16f4ea8bd256f94e190ee61c9d383e2c6bd13
                                                                                                                                                                                                                                  • Instruction ID: 6e34dd1f7dab7f705aad8222ad9522cd919a65157fb2dd6d6de2d5d28c492841
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3608daf4efc6c9f0c03ce24313c16f4ea8bd256f94e190ee61c9d383e2c6bd13
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 324131B290C2209FD7057F19DC856BAFBE4EF58724F16492DEAC893340D6715850CB97
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A003D0 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                  • Instruction ID: 9d652edabb38e87c9688a492baaea174bc427678d75312c3a4ab0396a6992524
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 051108BB34008A47D614CB2DF4B4FB7A795EBC5320F6D437AD3414B6D4D223E9459508
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009A2A10 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 216networkCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 009A2B39
                                                                                                                                                                                                                                  • HttpOpenRequestA.WININET(00000000,eknt,?,00000000,00000000,00000000,80000000,00000000), ref: 009A2BB2
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,00000000), ref: 009A2BDE
                                                                                                                                                                                                                                  • InternetQueryOptionA.WININET(00000000,0000001F,80000000,00000000), ref: 009A2C09
                                                                                                                                                                                                                                  • InternetSetOptionA.WININET(00000000,0000001F,00000100,00000004), ref: 009A2C1F
                                                                                                                                                                                                                                  • HttpQueryInfoA.WININET(00000000,20000005,?,00000000,00000000), ref: 009A2C3B
                                                                                                                                                                                                                                  • InternetCloseHandle.WININET(00000000), ref: 009A2C4D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Internet$Option$HttpQuery$CloseErrorHandleInfoLastOpenRequest
                                                                                                                                                                                                                                  • String ID: eknt
                                                                                                                                                                                                                                  • API String ID: 3343719359-3307737056
                                                                                                                                                                                                                                  • Opcode ID: 5f9540f2ac2bdf7c6650422f3c2ef2b039ab2460f039002d27c34a044b0d5812
                                                                                                                                                                                                                                  • Instruction ID: 038e21758d13b5a61dcb723d634f6a98e3d70e67270f5e136df910f71003d70e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5f9540f2ac2bdf7c6650422f3c2ef2b039ab2460f039002d27c34a044b0d5812
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4571D771A40209ABEB24DFA8DC45FFEBBB8EF49714F204159F905B72C0D7B49A448794
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092B1A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,0097E8D7,?,00000000), ref: 0092B207
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B24F
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B260
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,00000005,?,?,0097E8D7,?,00000000), ref: 0092B2B5
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B2E4
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B2F5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Cpp_errorThrow_std::_$CreateDirectoryErrorLast
                                                                                                                                                                                                                                  • String ID: \*.*
                                                                                                                                                                                                                                  • API String ID: 460572287-1173974218
                                                                                                                                                                                                                                  • Opcode ID: c403d9ce00c9c43153a3b0a3c473774383ef29c94754ba9eeedb18412248e9cc
                                                                                                                                                                                                                                  • Instruction ID: d0f74c0c5f357c3bbc713e531cc22d99effa04e7600df2ccf87e1c510f4f2335
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c403d9ce00c9c43153a3b0a3c473774383ef29c94754ba9eeedb18412248e9cc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 883144B1900724EBCB209FA9FC0677D37ACEB57724F104725E535936D8DB71490087A2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A14D9F Relevance: 10.8, APIs: 7, Instructions: 329COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _strrchr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3213747228-0
                                                                                                                                                                                                                                  • Opcode ID: de241dd55b422ed1e4ea048f00bb23ff873d8577d80bba1863d2e2f735cfcc17
                                                                                                                                                                                                                                  • Instruction ID: bfffae147f61b423ae715cd05c7ed63b82eb0c0f143b20602f6e16b3d90641cd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: de241dd55b422ed1e4ea048f00bb23ff873d8577d80bba1863d2e2f735cfcc17
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F8B13772E00765DFDB118F68CC81BEEBBA5EF9D750F184165E904AF382D2749981C7A0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00928130 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 320COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 009285AC
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 009285C2
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___std_exception_destroy
                                                                                                                                                                                                                                  • String ID: at line $, column $parse error$ror
                                                                                                                                                                                                                                  • API String ID: 4194217158-697689061
                                                                                                                                                                                                                                  • Opcode ID: 4a2ffa45a03495f140280fd4643985c73beb41e3f620d6db6fd8c34372aa7ffd
                                                                                                                                                                                                                                  • Instruction ID: 2e9c13190ca8e8eab7ba82837bd5a19272e8c0aa4290c38a780818b6e1581df5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4a2ffa45a03495f140280fd4643985c73beb41e3f620d6db6fd8c34372aa7ffd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B9D1FD71C01258DFEB04DFA8DD45BEEFBB5AF91300F208289E0146B292C7B55B84CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A00500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A00537
                                                                                                                                                                                                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00A0053F
                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A005C8
                                                                                                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00A005F3
                                                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A00648
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                                  • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                                  • Opcode ID: c8a96e83cef58d7dc332b679481907b35c34c75be424eb4d027d06bdd0908a9a
                                                                                                                                                                                                                                  • Instruction ID: df2bab6c17a08ac7e409169826696fb4fc6d963d403e2e5a2de6d66d52aa0425
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8a96e83cef58d7dc332b679481907b35c34c75be424eb4d027d06bdd0908a9a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE415A34A0021CABCF10DF68EC85F9EBBA5AF45324F148156E8189B2D2D772EA51CF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00989270 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009892AD
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009892CF
                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 009892F7
                                                                                                                                                                                                                                  • __Getctype.LIBCPMT ref: 009893D5
                                                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 00989409
                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00989433
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1102183713-0
                                                                                                                                                                                                                                  • Opcode ID: d23d2ff29b6d0fbd56a61fbe2721dbaba991170a70c71e281b5b02658a2fb641
                                                                                                                                                                                                                                  • Instruction ID: 79d51d7512e0fd22664308e51fd451b1c098884519128308b658b7c716b81a24
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d23d2ff29b6d0fbd56a61fbe2721dbaba991170a70c71e281b5b02658a2fb641
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C51DBB1D01249DFCB10DFA8C9457AEBBF4FB40324F288159E945AB381D774AA05CBD1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092B300 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 297COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B714
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0092B725
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Cpp_errorThrow_std::_
                                                                                                                                                                                                                                  • String ID: \*.*
                                                                                                                                                                                                                                  • API String ID: 2134207285-1173974218
                                                                                                                                                                                                                                  • Opcode ID: d3657662607b157f9c8b514a2781f5adaeb199301bd4b70cbb49fc6a17ac3158
                                                                                                                                                                                                                                  • Instruction ID: 3a6bd53ad82993317e7311292e1865473160fb19b8684d30468881f6f1565e10
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3657662607b157f9c8b514a2781f5adaeb199301bd4b70cbb49fc6a17ac3158
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88C10070C00259DFDF20DFA8DC887EDBBB5BF55314F244248E054AB296D7B19A89CB61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0092BD50 Relevance: 7.6, APIs: 5, Instructions: 132COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e442e75bd60b1235f2b8e51f34f5ffc1b9e4c4bf6eeeb9a536c9620a15ba231c
                                                                                                                                                                                                                                  • Instruction ID: 9c8e75e083086b3125e245321b427e0496393088df1914cf1884198a8da21b45
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e442e75bd60b1235f2b8e51f34f5ffc1b9e4c4bf6eeeb9a536c9620a15ba231c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F55146B0D1075AEBEB10CFA8DC04BAEBFB4FF55704F14421AE5047A291D3B669948BE0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0098B4D0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0098B4FA
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0098B51C
                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0098B544
                                                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 0098B63A
                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0098B664
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 459529453-0
                                                                                                                                                                                                                                  • Opcode ID: 01ec3303bae5987732a85e803e51de357e57af977c525af95d0963d307d0bc3b
                                                                                                                                                                                                                                  • Instruction ID: 1cddcfdb3c58c781660650b065d9362c5191be942627f817e85daa355e92a1b0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 01ec3303bae5987732a85e803e51de357e57af977c525af95d0963d307d0bc3b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4251CCB0900249DFCB20DF98D844BAEBBF4FF41324F28815CE845AB381D7B5AA45CB80
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00924510 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009245AF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                                                                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                                                  • API String ID: 323602529-1866435925
                                                                                                                                                                                                                                  • Opcode ID: eb910c53b3b58c60b0f4326111056af67335859fb96a83678b4fcefcb8aed66b
                                                                                                                                                                                                                                  • Instruction ID: 79df2036bc087ff85fb217b4429e5f894d1d4a4323940deafe802708aadc3364
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eb910c53b3b58c60b0f4326111056af67335859fb96a83678b4fcefcb8aed66b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EA114CB2804658BBC710EF5CFC02F76339CAB44710F144A69FE958B5C1EB35A904CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 009FB959 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __EH_prolog3.LIBCMT ref: 009FB960
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009FB96B
                                                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 009FB9D9
                                                                                                                                                                                                                                    • Part of subcall function 009FBABC: std::locale::_Locimp::_Locimp.LIBCPMT ref: 009FBAD4
                                                                                                                                                                                                                                  • std::locale::_Setgloballocale.LIBCPMT ref: 009FB986
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 677527491-0
                                                                                                                                                                                                                                  • Opcode ID: a122bcf4dc4e18ba09c31a741deb4140d12fcde30e2850cbba83fab1bef64f1c
                                                                                                                                                                                                                                  • Instruction ID: a70e97bf84541923394e2eafa079b90a6bc1fa448d1a620ec45ffba2448e31a9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a122bcf4dc4e18ba09c31a741deb4140d12fcde30e2850cbba83fab1bef64f1c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA01BC36A00229ABCB06EF64D86173D77B1BFC4790B144009EA115B381DFB4AE03CBC0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00927EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 0092807C
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00928092
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___std_exception_destroy
                                                                                                                                                                                                                                  • String ID: [json.exception.
                                                                                                                                                                                                                                  • API String ID: 4194217158-791563284
                                                                                                                                                                                                                                  • Opcode ID: 474cb308fd0f9cf89427d4da1cf8b06b356ff295c077c64b4cef7c4fcb7ceb78
                                                                                                                                                                                                                                  • Instruction ID: 62e4f838b5f3c1c4235b61c460921f0379270c1766d3183aaac218817f1d94a7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 474cb308fd0f9cf89427d4da1cf8b06b356ff295c077c64b4cef7c4fcb7ceb78
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 585101B0C04248EFDB10DFA8D905BAEFBB4EF51314F104269E800AB7C2E7B85A44C7A1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00924400 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009245AF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                                                                                  • String ID: ios_base::badbit set$ios_base::failbit set
                                                                                                                                                                                                                                  • API String ID: 323602529-1240500531
                                                                                                                                                                                                                                  • Opcode ID: 70199e24b633d8da8f1bc0eeeaf3574703c7f8cd3dcc509b35c3fbc1878d8132
                                                                                                                                                                                                                                  • Instruction ID: 4a90d4dbc8abc6e72b9484da8e22778adf62939f74886851b15834374893b487
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70199e24b633d8da8f1bc0eeeaf3574703c7f8cd3dcc509b35c3fbc1878d8132
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 174155B1C00218ABCB04DF58EC41BAEBBF8EF44710F24825DF955AB281D775AE00CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0093E5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0093E739
                                                                                                                                                                                                                                  • std::_Throw_Cpp_error.LIBCPMT ref: 0093E74A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Cpp_errorThrow_std::_
                                                                                                                                                                                                                                  • String ID: m
                                                                                                                                                                                                                                  • API String ID: 2134207285-3775001192
                                                                                                                                                                                                                                  • Opcode ID: d9bd3dd898a33630533dd43353b27130a9158cea79bf8f72e60774c87d9a746b
                                                                                                                                                                                                                                  • Instruction ID: 5e64962753b58b0f70377ece501188e3e58366b5a97e144cf7931e9143eb64a6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9bd3dd898a33630533dd43353b27130a9158cea79bf8f72e60774c87d9a746b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A311870804388EBDB05DFA8C956BEE7B74EF55308F204299E4111B2E2D7B59645C7D1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00923C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00923C81
                                                                                                                                                                                                                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00923CE4
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                                  • String ID: bad locale name
                                                                                                                                                                                                                                  • API String ID: 3988782225-1405518554
                                                                                                                                                                                                                                  • Opcode ID: d85822d7993fa65c0c6a7f7542d09c2c018a333955b7d578fee70b998c2cb5cd
                                                                                                                                                                                                                                  • Instruction ID: cc16cff13e9b27e576df99f6d5d316bad5df7ac5b67229a6235181c2cb567564
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d85822d7993fa65c0c6a7f7542d09c2c018a333955b7d578fee70b998c2cb5cd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D11D370805B84EED721CF68C50474BBFF4AF15710F14869DE09597B81D3B9A604C792
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00A0C863 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A0C8AA
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2654615458.0000000000921000.00000020.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654584464.0000000000920000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654714802.0000000000A35000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654800312.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654829607.0000000000A65000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654880315.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000ABB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BA8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BAE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB0000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB2000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB4000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB6000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BB8000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBA000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBC000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BEF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF1000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF3000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF5000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BF9000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFB000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFD000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000BFF000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C01000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C05000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C07000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2654915199.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657326702.0000000000E71000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657423753.0000000000F20000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657459441.0000000000F21000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2657999465.0000000001313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_920000_yyfBua979C0ZzSPnCxybIlhk.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                  • API String ID: 190572456-1276376045
                                                                                                                                                                                                                                  • Opcode ID: bbe62ec636c72abdb3067fd3f48e85fcca755ecb91cfe510ca65a4805193b61d
                                                                                                                                                                                                                                  • Instruction ID: 1d8a69ff11988c8b233362d88c6e7af0e84654fed75aaf5c32c7de9a46e921d6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bbe62ec636c72abdb3067fd3f48e85fcca755ecb91cfe510ca65a4805193b61d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 63016232944A59AFDB118B94EC05FAEB7F8FB04B61F008625F811A26E0DBB59905CA94
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:7.4%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:7.1%
                                                                                                                                                                                                                                  Signature Coverage:0.9%
                                                                                                                                                                                                                                  Total number of Nodes:1293
                                                                                                                                                                                                                                  Total number of Limit Nodes:50
                                                                                                                                                                                                                                  execution_graph 58484 69836bc0 58485 69836bde 58484->58485 58486 69836c26 58485->58486 58494 69889d21 58485->58494 58488 69836bf7 58489 69836c1d 58488->58489 58498 69835300 58488->58498 58493 69836c3c 58495 6988e8d5 __EH_prolog3_catch 58494->58495 58506 69889bb5 58495->58506 58497 6988e8ed _Fac_tidy 58497->58488 58500 69835322 58498->58500 58499 69835329 58499->58489 58502 69836c60 SafeArrayCreateVector SafeArrayAccessData 58499->58502 58500->58499 58547 69835840 5 API calls __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 58500->58547 58503 69836c91 _memmove 58502->58503 58504 69836cad 58502->58504 58505 69836c9f SafeArrayUnaccessData 58503->58505 58504->58493 58505->58504 58509 69889bbf 58506->58509 58508 69889bd9 58508->58497 58509->58508 58511 69889bdb std::exception::exception 58509->58511 58518 69889d66 58509->58518 58535 6988c86e DecodePointer 58509->58535 58516 69889c19 58511->58516 58536 69889af4 76 API calls __cinit 58511->58536 58513 69889c23 58538 6988ac75 RaiseException 58513->58538 58537 698895c1 66 API calls std::exception::operator= 58516->58537 58517 69889c34 58519 69889de3 58518->58519 58532 69889d74 58518->58532 58545 6988c86e DecodePointer 58519->58545 58521 69889d7f 58521->58532 58539 6988d74e 66 API calls 2 library calls 58521->58539 58540 6988d59f 66 API calls 7 library calls 58521->58540 58541 6988d279 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 58521->58541 58522 69889de9 58546 6988d7d8 66 API calls __getptd_noexit 58522->58546 58525 69889da2 RtlAllocateHeap 58527 69889ddb 58525->58527 58525->58532 58527->58509 58528 69889dcf 58543 6988d7d8 66 API calls __getptd_noexit 58528->58543 58532->58521 58532->58525 58532->58528 58533 69889dcd 58532->58533 58542 6988c86e DecodePointer 58532->58542 58544 6988d7d8 66 API calls __getptd_noexit 58533->58544 58535->58509 58536->58516 58537->58513 58538->58517 58539->58521 58540->58521 58542->58532 58543->58533 58544->58527 58545->58522 58546->58527 58547->58499 59544 69849357 59545 69849368 59544->59545 59681 698469c0 59545->59681 59547 6984ae62 SafeArrayDestroy 59548 6984ae68 59547->59548 59550 6984ae72 SafeArrayDestroy 59548->59550 59551 6984ae7b 59548->59551 59549 698493ac 59552 698469c0 11 API calls 59549->59552 59650 69848739 59549->59650 59550->59551 59553 6984ae85 SafeArrayDestroy 59551->59553 59554 6984ae8e 59551->59554 59563 6984943a 59552->59563 59553->59554 59555 6984aea1 59554->59555 59556 6984ae98 SafeArrayDestroy 59554->59556 59557 6984aeb4 59555->59557 59558 6984aeab SafeArrayDestroy 59555->59558 59556->59555 59559 6984aec7 59557->59559 59560 6984aebe SafeArrayDestroy 59557->59560 59558->59557 59561 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59559->59561 59560->59559 59562 6984aef5 59561->59562 59564 698494b1 SafeArrayGetLBound SafeArrayGetUBound 59563->59564 59563->59650 59565 69849658 59564->59565 59570 698494ef 59564->59570 59566 6983d920 3 API calls 59565->59566 59572 6984968f 59566->59572 59567 698494fd SafeArrayGetElement 59567->59570 59567->59650 59568 6984840e 59568->59650 59729 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59568->59729 59570->59565 59570->59567 59570->59568 59570->59650 59571 69848441 59573 698484af SafeArrayGetLBound SafeArrayGetUBound 59571->59573 59571->59650 59580 69849794 SafeArrayGetLBound SafeArrayGetUBound 59572->59580 59572->59650 59574 69848616 59573->59574 59575 698484ed SafeArrayGetElement 59573->59575 59730 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59574->59730 59584 69848518 59575->59584 59575->59650 59577 6984862b 59577->59650 59731 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59577->59731 59579 6984864b 59579->59650 59732 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59579->59732 59591 69849c5e 59580->59591 59605 698497d2 59580->59605 59582 6984866b 59582->59650 59733 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59582->59733 59583 69843a90 8 API calls 59583->59584 59584->59574 59584->59575 59584->59583 59585 698497e3 SafeArrayGetElement 59585->59605 59585->59650 59587 6983d920 3 API calls 59594 69849cf8 59587->59594 59588 6984868a 59588->59650 59734 6983dfb0 SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement 59588->59734 59590 698486aa 59592 698469c0 11 API calls 59590->59592 59590->59650 59591->59587 59593 698486cf 59592->59593 59595 698469c0 11 API calls 59593->59595 59593->59650 59597 69849d4f SafeArrayGetLBound SafeArrayGetUBound 59594->59597 59594->59650 59596 698486f5 59595->59596 59600 698469c0 11 API calls 59596->59600 59596->59650 59598 69849ec7 59597->59598 59606 69849d8d 59597->59606 59601 6983d920 3 API calls 59598->59601 59599 69849da0 SafeArrayGetElement 59599->59606 59599->59650 59600->59650 59602 69849f09 59601->59602 59603 6983d920 3 API calls 59602->59603 59602->59650 59607 69849f8b 59603->59607 59604 69843a90 8 API calls 59604->59606 59605->59568 59605->59585 59605->59591 59609 69843a90 8 API calls 59605->59609 59606->59598 59606->59599 59606->59604 59608 6983d920 3 API calls 59607->59608 59607->59650 59610 6984a01f 59608->59610 59609->59605 59611 6983d920 3 API calls 59610->59611 59610->59650 59612 6984a09b 59611->59612 59613 6984a1ac SafeArrayGetLBound SafeArrayGetUBound 59612->59613 59612->59650 59614 6984a7b3 59613->59614 59628 6984a1ea 59613->59628 59615 6983d920 3 API calls 59614->59615 59617 6984a7ce 59615->59617 59616 6984a1fd SafeArrayGetElement 59619 6984a815 59616->59619 59616->59628 59618 6983d920 3 API calls 59617->59618 59617->59650 59618->59619 59619->59650 59688 698464d0 VariantInit VariantInit VariantInit SafeArrayCreateVector 59619->59688 59621 6984a91d 59622 698464d0 109 API calls 59621->59622 59621->59650 59623 6984a950 59622->59623 59624 698464d0 109 API calls 59623->59624 59623->59650 59625 6984a983 59624->59625 59626 698464d0 109 API calls 59625->59626 59625->59650 59627 6984a9b6 59626->59627 59629 698464d0 109 API calls 59627->59629 59627->59650 59628->59614 59628->59616 59637 69843a90 8 API calls 59628->59637 59630 6984a9e9 59629->59630 59631 698464d0 109 API calls 59630->59631 59630->59650 59632 6984aa1c 59631->59632 59633 698464d0 109 API calls 59632->59633 59632->59650 59634 6984aa4f 59633->59634 59635 698464d0 109 API calls 59634->59635 59634->59650 59636 6984aa82 59635->59636 59638 698464d0 109 API calls 59636->59638 59636->59650 59637->59628 59639 6984aab5 59638->59639 59640 698464d0 109 API calls 59639->59640 59639->59650 59641 6984aae8 59640->59641 59642 698464d0 109 API calls 59641->59642 59641->59650 59643 6984ab1e 59642->59643 59644 6984abd0 59643->59644 59648 6984ac5a 59643->59648 59643->59650 59702 69842970 59644->59702 59735 6984d790 77 API calls 3 library calls 59648->59735 59650->59547 59650->59548 59651 6984ac37 59651->59650 59736 69831690 77 API calls 59651->59736 59653 6984ad36 59737 698350c0 77 API calls 59653->59737 59655 6984ad4d 59656 69889bb5 77 API calls 59655->59656 59657 6984ad5d 59656->59657 59658 69835050 77 API calls 59657->59658 59659 6984ad77 59658->59659 59738 698350c0 77 API calls 59659->59738 59661 6984ad82 59662 69889bb5 77 API calls 59661->59662 59663 6984ad89 59662->59663 59664 69835050 77 API calls 59663->59664 59665 6984ada7 59664->59665 59666 69889bb5 77 API calls 59665->59666 59667 6984adae 59666->59667 59668 69835050 77 API calls 59667->59668 59669 6984adcc 59668->59669 59739 698350c0 77 API calls 59669->59739 59671 6984add7 59672 69889bb5 77 API calls 59671->59672 59673 6984ade1 59672->59673 59674 69835050 77 API calls 59673->59674 59675 6984adfb 59674->59675 59740 698350c0 77 API calls 59675->59740 59677 6984ae06 59741 698350c0 77 API calls 59677->59741 59679 6984ae11 59742 69832a40 327 API calls 59679->59742 59682 69846a01 SafeArrayGetLBound SafeArrayGetUBound 59681->59682 59683 698469f3 59681->59683 59686 69846a2a 59682->59686 59687 69846a92 59682->59687 59683->59682 59684 69846a30 SafeArrayGetElement 59684->59686 59684->59687 59686->59684 59686->59687 59743 69843990 8 API calls 59686->59743 59687->59549 59689 69846554 59688->59689 59690 6984655c SafeArrayPutElement VariantClear 59688->59690 59689->59690 59691 69846584 SafeArrayPutElement VariantClear 59690->59691 59692 69846655 59690->59692 59691->59692 59696 698465cd 59691->59696 59694 69846665 SafeArrayDestroy 59692->59694 59695 6984666c VariantClear VariantClear VariantClear 59692->59695 59694->59695 59695->59621 59696->59692 59697 6983db30 5 API calls 59696->59697 59698 6984663a 59697->59698 59698->59692 59699 698456b0 83 API calls 59698->59699 59700 6984664a 59699->59700 59701 69846880 9 API calls 59700->59701 59701->59692 59714 698429c3 59702->59714 59703 69842d21 59703->59650 59716 6984d2e0 59703->59716 59704 698429ee SafeArrayGetLBound SafeArrayGetUBound 59706 69842a20 SafeArrayGetElement 59704->59706 59710 69842c53 59704->59710 59705 69842d1a SafeArrayDestroy 59705->59703 59706->59710 59706->59714 59707 69842ab6 VariantInit 59707->59714 59708 69842b3a VariantInit 59708->59714 59709 69842c8b VariantClear VariantClear 59709->59710 59710->59703 59710->59705 59711 69842d3a VariantClear VariantClear VariantClear 59711->59710 59712 69842cb6 VariantClear VariantClear VariantClear 59712->59710 59713 69842bf9 VariantClear VariantClear VariantClear 59713->59714 59714->59703 59714->59704 59714->59706 59714->59707 59714->59708 59714->59709 59714->59710 59714->59711 59714->59712 59714->59713 59717 69889bb5 77 API calls 59716->59717 59718 6984d32f 59717->59718 59719 6984d3db 59718->59719 59721 6984d33e 59718->59721 59755 69889533 66 API calls std::exception::_Copy_str 59719->59755 59744 6984c530 VariantInit VariantInit SafeArrayCreateVector 59721->59744 59722 6984d3ed 59756 6988ac75 RaiseException 59722->59756 59725 6984d404 59727 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59728 6984d3d5 59727->59728 59728->59651 59729->59571 59730->59577 59731->59579 59732->59582 59733->59588 59734->59590 59735->59651 59736->59653 59737->59655 59738->59661 59739->59671 59740->59677 59741->59679 59742->59650 59743->59686 59745 6984c5a4 59744->59745 59746 6984c5ac SafeArrayPutElement VariantClear 59744->59746 59745->59746 59747 6984c7e4 59746->59747 59751 6984c5cf 59746->59751 59748 6984c7f7 VariantClear VariantClear 59747->59748 59749 6984c7f0 SafeArrayDestroy 59747->59749 59750 6984c817 59748->59750 59749->59748 59750->59727 59751->59747 59752 6984c7d9 59751->59752 59760 6988919e 67 API calls 3 library calls 59751->59760 59757 6984df70 59752->59757 59755->59722 59756->59725 59761 6984d410 59757->59761 59759 6984df80 59759->59747 59760->59752 59762 6984d472 VariantInit VariantInit VariantInit 59761->59762 59763 6984d44e 59761->59763 59775 6984d470 _memmove 59762->59775 59763->59759 59764 6984d704 VariantClear VariantClear VariantClear 59766 6984d75d 59764->59766 59764->59775 59765 69889d66 _malloc 66 API calls 59765->59775 59766->59759 59767 6984d579 SafeArrayCreateVector SafeArrayCreateVector SafeArrayAccessData 59767->59775 59768 6984d5ec SafeArrayPutElement 59768->59775 59769 6984d5d6 SafeArrayUnaccessData 59769->59768 59770 6984d633 SafeArrayPutElement VariantClear 59770->59775 59772 6984d6fa SafeArrayDestroy 59772->59775 59773 6983db30 5 API calls 59773->59775 59774 698456b0 83 API calls 59774->59775 59775->59762 59775->59764 59775->59765 59775->59766 59775->59767 59775->59768 59775->59769 59775->59770 59775->59772 59775->59773 59775->59774 59776 69846880 9 API calls 59775->59776 59777 69889d2c 66 API calls 2 library calls 59775->59777 59776->59775 59777->59775 59782 5ab5208 59783 5ab5252 LoadLibraryW 59782->59783 59785 5ab52b4 59783->59785 59786 6988a42d 59787 6988a438 59786->59787 59788 6988a4b8 __write 59786->59788 59787->59788 59792 6988a468 59787->59792 59794 6988a2ab 59787->59794 59790 6988a498 59790->59788 59791 6988a2ab __CRT_INIT@12 149 API calls 59790->59791 59791->59788 59792->59788 59792->59790 59793 6988a2ab __CRT_INIT@12 149 API calls 59792->59793 59793->59790 59795 6988a2b7 __write 59794->59795 59796 6988a339 59795->59796 59797 6988a2bf 59795->59797 59799 6988a39a 59796->59799 59800 6988a33f 59796->59800 59846 6988e904 HeapCreate 59797->59846 59801 6988a3f8 59799->59801 59802 6988a39f 59799->59802 59806 6988a35d 59800->59806 59813 6988a2c8 __write 59800->59813 59856 6988d4e7 66 API calls _doexit 59800->59856 59801->59813 59864 6988ec2f 79 API calls __freefls@4 59801->59864 59804 6988e948 ___set_flsgetvalue 3 API calls 59802->59804 59803 6988a2c4 59805 6988a2cf 59803->59805 59803->59813 59808 6988a3a4 59804->59808 59847 6988ec9d 86 API calls 4 library calls 59805->59847 59811 6988a371 59806->59811 59857 6988dd67 67 API calls type_info::_Type_info_dtor 59806->59857 59861 6988cb28 66 API calls __calloc_crt 59808->59861 59860 6988a384 70 API calls __mtterm 59811->59860 59813->59792 59815 6988a2d4 __RTC_Initialize 59818 6988a2d8 59815->59818 59823 6988a2e4 GetCommandLineA 59815->59823 59817 6988a3b0 59817->59813 59820 6988a3bc DecodePointer 59817->59820 59848 6988e922 HeapDestroy 59818->59848 59819 6988a367 59858 6988e97c 70 API calls type_info::_Type_info_dtor 59819->59858 59828 6988a3d1 59820->59828 59849 6988fc46 71 API calls 2 library calls 59823->59849 59824 6988a2dd 59824->59813 59825 6988a36c 59859 6988e922 HeapDestroy 59825->59859 59830 6988a3ec 59828->59830 59831 6988a3d5 59828->59831 59829 6988a2f4 59850 6988db22 73 API calls __calloc_crt 59829->59850 59863 69889d2c 66 API calls 2 library calls 59830->59863 59862 6988e9b9 66 API calls 4 library calls 59831->59862 59835 6988a2fe 59837 6988a302 59835->59837 59852 6988fb8b 95 API calls 3 library calls 59835->59852 59836 6988a3dc GetCurrentThreadId 59836->59813 59851 6988e97c 70 API calls type_info::_Type_info_dtor 59837->59851 59840 6988a30e 59841 6988a322 59840->59841 59853 6988f915 94 API calls 6 library calls 59840->59853 59841->59824 59855 6988dd67 67 API calls type_info::_Type_info_dtor 59841->59855 59844 6988a317 59844->59841 59854 6988d2fa 77 API calls 4 library calls 59844->59854 59846->59803 59847->59815 59848->59824 59849->59829 59850->59835 59851->59818 59852->59840 59853->59844 59854->59841 59855->59837 59856->59806 59857->59819 59858->59825 59859->59811 59860->59813 59861->59817 59862->59836 59863->59824 59864->59813 59778 6988a510 59779 6988a515 59778->59779 59781 6988fe93 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 59778->59781 59781->59779 58548 6984e2ce 58549 69889bb5 77 API calls 58548->58549 58550 6984e2d5 58549->58550 58551 6984e2ee 58550->58551 58605 69851fd0 58550->58605 58553 6984e343 58551->58553 58554 69889bb5 77 API calls 58551->58554 58555 6984e3a6 58553->58555 58556 6984e360 58553->58556 58557 6984e327 58554->58557 58560 69889bb5 77 API calls 58555->58560 58604 6984e564 _Fac_tidy 58555->58604 58558 69889bb5 77 API calls 58556->58558 58630 6984eae0 58557->58630 58561 6984e367 58558->58561 58564 6984e400 58560->58564 58645 69851910 78 API calls 2 library calls 58561->58645 58562 6984e76e 58567 69889bb5 77 API calls 58564->58567 58566 6984e384 58646 69851b20 11 API calls __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 58566->58646 58569 6984e428 58567->58569 58647 69835050 58569->58647 58570 6984e399 58570->58555 58572 6984e442 58573 69889bb5 77 API calls 58572->58573 58574 6984e449 58573->58574 58575 69835050 77 API calls 58574->58575 58576 6984e463 58575->58576 58577 69889bb5 77 API calls 58576->58577 58578 6984e46a 58577->58578 58579 69835050 77 API calls 58578->58579 58580 6984e484 58579->58580 58581 69889bb5 77 API calls 58580->58581 58582 6984e48b 58581->58582 58583 69835050 77 API calls 58582->58583 58584 6984e4a5 58583->58584 58585 69889bb5 77 API calls 58584->58585 58586 6984e4ac 58585->58586 58587 69835050 77 API calls 58586->58587 58588 6984e4c6 58587->58588 58589 6984e4d3 58588->58589 58655 6988919e 67 API calls 3 library calls 58588->58655 58591 69889bb5 77 API calls 58589->58591 58592 6984e4e3 58591->58592 58593 69835050 77 API calls 58592->58593 58594 6984e4fd 58593->58594 58595 69889bb5 77 API calls 58594->58595 58596 6984e504 58595->58596 58597 69835050 77 API calls 58596->58597 58598 6984e51e 58597->58598 58599 69889bb5 77 API calls 58598->58599 58600 6984e525 58599->58600 58601 69835050 77 API calls 58600->58601 58602 6984e53f 58601->58602 58656 698316b0 58602->58656 58720 6988948b 58604->58720 58606 69889bb5 77 API calls 58605->58606 58607 69852013 58606->58607 58608 69852020 58607->58608 58609 698521f3 58607->58609 58728 69856480 58608->58728 58762 69889533 66 API calls std::exception::_Copy_str 58609->58762 58612 6985220b 58763 6988ac75 RaiseException 58612->58763 58614 69852226 58615 6985206c 58744 698235f0 58615->58744 58617 6985216e 58755 69852300 58617->58755 58619 69852194 58620 69852300 77 API calls 58619->58620 58621 698521a0 58620->58621 58622 69852300 77 API calls 58621->58622 58623 698521ad 58622->58623 58624 69852300 77 API calls 58623->58624 58625 698521ba 58624->58625 58626 69852300 77 API calls 58625->58626 58627 698521c6 58626->58627 58628 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58627->58628 58629 698521ef 58628->58629 58629->58551 58631 69889bb5 77 API calls 58630->58631 58632 6984eb17 58631->58632 58633 6984eb22 58632->58633 58634 6984f4c9 58632->58634 58808 6988a25a GetSystemTimeAsFileTime 58633->58808 58816 69889533 66 API calls std::exception::_Copy_str 58634->58816 58636 6984f4dc 58817 6988ac75 RaiseException 58636->58817 58639 6984f4f1 58640 6984eb5b 58810 69889dfa 58640->58810 58645->58566 58646->58570 58648 69835091 58647->58648 58649 6983505d 58647->58649 58651 6983509d 58648->58651 58846 69835110 77 API calls std::_Xinvalid_argument 58648->58846 58649->58648 58650 69835066 58649->58650 58654 6983507a 58650->58654 58845 69835110 77 API calls std::_Xinvalid_argument 58650->58845 58651->58572 58654->58572 58655->58589 58657 69889bb5 77 API calls 58656->58657 58658 69831706 58657->58658 58659 69831711 58658->58659 58660 69831c39 58658->58660 58847 69832d70 58659->58847 58899 69889533 66 API calls std::exception::_Copy_str 58660->58899 58663 69831c48 58900 6988ac75 RaiseException 58663->58900 58666 69831c5d 58667 69832d70 77 API calls 58668 69831788 58667->58668 58669 69832d70 77 API calls 58668->58669 58670 698317a9 58669->58670 58671 69832d70 77 API calls 58670->58671 58672 698317ca 58671->58672 58673 69832d70 77 API calls 58672->58673 58674 698317e6 58673->58674 58675 69832d70 77 API calls 58674->58675 58676 6983182f 58675->58676 58677 69832d70 77 API calls 58676->58677 58678 69831878 58677->58678 58679 69832d70 77 API calls 58678->58679 58680 698318c6 58679->58680 58681 69832d70 77 API calls 58680->58681 58682 698318e7 58681->58682 58683 69832d70 77 API calls 58682->58683 58684 69831900 58683->58684 58685 69832d70 77 API calls 58684->58685 58686 69831946 58685->58686 58687 69832d70 77 API calls 58686->58687 58688 6983198f 58687->58688 58689 69832d70 77 API calls 58688->58689 58690 698319d3 58689->58690 58691 69832d70 77 API calls 58690->58691 58692 69831a05 58691->58692 58855 69833b30 58692->58855 58695 69832d70 77 API calls 58696 69831a21 58695->58696 58697 69832d70 77 API calls 58696->58697 58698 69831a82 58697->58698 58864 69833bd0 58698->58864 58701 69832d70 77 API calls 58702 69831a9e 58701->58702 58703 69832d70 77 API calls 58702->58703 58704 69831aec 58703->58704 58873 69832a80 58704->58873 58706 69831b4c 58708 69831b62 58706->58708 58896 6988919e 67 API calls 3 library calls 58706->58896 58707 69831b58 58897 69889125 67 API calls 2 library calls 58707->58897 58879 698530c0 58708->58879 58883 698369e0 58708->58883 58887 698542e0 58708->58887 58891 69836850 58708->58891 58712 69831b00 58712->58706 58712->58707 58713 69831b6d _Fac_tidy 58712->58713 58895 69832e60 77 API calls __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 58712->58895 58898 69833530 67 API calls 58713->58898 58715 69831ba1 _Fac_tidy 58715->58604 58721 69889493 58720->58721 58722 69889495 IsDebuggerPresent 58720->58722 58721->58562 59494 69890036 58722->59494 58725 6988ce7e SetUnhandledExceptionFilter UnhandledExceptionFilter 58726 6988ce9b __call_reportfault 58725->58726 58727 6988cea3 GetCurrentProcess TerminateProcess 58725->58727 58726->58727 58727->58562 58729 6985655d 58728->58729 58732 698564c8 58728->58732 58730 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58729->58730 58731 6985657d 58730->58731 58731->58615 58732->58729 58733 6985651d 58732->58733 58764 69822f40 77 API calls 58732->58764 58733->58729 58767 69822f40 77 API calls 58733->58767 58736 698564f5 58765 69856400 77 API calls std::tr1::_Xweak 58736->58765 58737 69856535 58768 69856400 77 API calls std::tr1::_Xweak 58737->58768 58740 6985654e 58769 6988ac75 RaiseException 58740->58769 58741 6985650e 58766 6988ac75 RaiseException 58741->58766 58770 69876d40 58744->58770 58747 69856480 77 API calls 58748 6982364c 58747->58748 58777 69824b30 58748->58777 58750 698236a7 58781 698586e0 58750->58781 58752 698236bc 58753 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58752->58753 58754 69823701 58753->58754 58754->58617 58756 6985231d 58755->58756 58757 698523aa 58756->58757 58758 69889bb5 77 API calls 58756->58758 58757->58619 58760 69852331 58758->58760 58759 69852374 _Fac_tidy 58759->58619 58760->58759 58807 69852480 77 API calls 58760->58807 58762->58612 58763->58614 58764->58736 58765->58741 58766->58733 58767->58737 58768->58740 58769->58729 58771 69856480 77 API calls 58770->58771 58772 69876d7f 58771->58772 58789 69858d80 58772->58789 58775 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58776 69823630 58775->58776 58776->58747 58778 69824b65 58777->58778 58799 69824fa0 58778->58799 58780 69824b7f 58780->58750 58785 69858728 58781->58785 58782 69858765 58783 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58782->58783 58784 6985878a 58783->58784 58784->58752 58785->58782 58805 69857cd0 77 API calls 3 library calls 58785->58805 58787 69858756 58806 6988ac75 RaiseException 58787->58806 58790 69889d66 _malloc 66 API calls 58789->58790 58792 69858d8f 58790->58792 58791 69858dbb 58791->58775 58792->58791 58793 698891f6 70 API calls 58792->58793 58794 69858dc1 std::exception::exception 58792->58794 58797 69889d66 _malloc 66 API calls 58792->58797 58793->58792 58798 6988ac75 RaiseException 58794->58798 58796 69858df0 58797->58792 58798->58796 58800 69889bb5 77 API calls 58799->58800 58801 69824fcf 58800->58801 58802 69824ff1 58801->58802 58804 69825050 81 API calls _memcpy_s 58801->58804 58802->58780 58804->58802 58805->58787 58806->58782 58807->58757 58809 6988a28a __aulldiv 58808->58809 58809->58640 58818 6988eae6 58810->58818 58813 69889e0c 58814 6988eae6 __getptd 66 API calls 58813->58814 58815 6984eb69 58814->58815 58815->58553 58816->58636 58817->58639 58823 6988ea6d GetLastError 58818->58823 58820 6988eaee 58821 6984eb61 58820->58821 58838 6988d4f6 66 API calls 3 library calls 58820->58838 58821->58813 58839 6988e948 TlsGetValue 58823->58839 58826 6988eada SetLastError 58826->58820 58827 6988ea8c 58842 6988cb28 66 API calls __calloc_crt 58827->58842 58829 6988ea98 58829->58826 58830 6988eaa0 DecodePointer 58829->58830 58831 6988eab5 58830->58831 58832 6988eab9 58831->58832 58833 6988ead1 58831->58833 58843 6988e9b9 66 API calls 4 library calls 58832->58843 58844 69889d2c 66 API calls 2 library calls 58833->58844 58836 6988eac1 GetCurrentThreadId 58836->58826 58837 6988ead7 58837->58826 58840 6988e978 58839->58840 58841 6988e95d DecodePointer TlsSetValue 58839->58841 58840->58826 58840->58827 58841->58840 58842->58829 58843->58836 58844->58837 58845->58654 58846->58651 58851 69832db8 58847->58851 58848 69832e0d 58853 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 58848->58853 58850 69832e02 58902 69833cc0 67 API calls 58850->58902 58851->58848 58901 69825a30 77 API calls 2 library calls 58851->58901 58854 69831746 58853->58854 58854->58667 58856 69833b3d 58855->58856 58857 69889bb5 77 API calls 58856->58857 58858 69833b6f 58857->58858 58859 69831a0c 58858->58859 58903 69889533 66 API calls std::exception::_Copy_str 58858->58903 58859->58695 58861 69833bae 58904 6988ac75 RaiseException 58861->58904 58863 69833bc3 58865 69833bdd 58864->58865 58866 69889bb5 77 API calls 58865->58866 58867 69833c0f 58866->58867 58868 69831a89 58867->58868 58905 69889533 66 API calls std::exception::_Copy_str 58867->58905 58868->58701 58870 69833c4e 58906 6988ac75 RaiseException 58870->58906 58872 69833c63 58874 69832acd 58873->58874 58878 69832ae6 58873->58878 58875 69832adf 58874->58875 58907 698890d8 67 API calls 2 library calls 58874->58907 58908 698331e0 77 API calls 2 library calls 58875->58908 58878->58712 58880 698530f8 58879->58880 58881 698530de 58879->58881 58880->58713 58909 69835fa0 58881->58909 58884 69836a1f 58883->58884 58885 698369fe 58883->58885 58884->58713 58930 69839110 58885->58930 58888 6985431d 58887->58888 58889 698542fe 58887->58889 58888->58713 59055 698362c0 58889->59055 58892 69836890 58891->58892 58893 6983686e 58891->58893 58892->58713 59082 69838bc0 58893->59082 58895->58712 58896->58707 58897->58708 58898->58715 58899->58663 58900->58666 58901->58850 58902->58848 58903->58861 58904->58863 58905->58870 58906->58872 58907->58875 58908->58878 58910 69889bb5 77 API calls 58909->58910 58911 69836003 58910->58911 58912 69889bb5 77 API calls 58911->58912 58913 69836028 58912->58913 58914 69835050 77 API calls 58913->58914 58915 69836042 58914->58915 58916 69889bb5 77 API calls 58915->58916 58917 69836049 58916->58917 58918 69835050 77 API calls 58917->58918 58919 69836067 58918->58919 58920 69889bb5 77 API calls 58919->58920 58921 6983606e 58920->58921 58922 69835050 77 API calls 58921->58922 58923 6983608b 58922->58923 58924 69889bb5 77 API calls 58923->58924 58925 69836092 58924->58925 58926 69835050 77 API calls 58925->58926 58927 698360ac 58926->58927 58928 698316b0 327 API calls 58927->58928 58929 698360de _Fac_tidy 58928->58929 58929->58880 58931 69839121 58930->58931 58932 6983912c EnterCriticalSection 58930->58932 58931->58884 58933 69839150 58932->58933 58934 6983915b LeaveCriticalSection 58933->58934 58935 6983923f 58934->58935 58936 6983916a EnterCriticalSection 58934->58936 58935->58884 58937 69839185 58936->58937 58938 69839190 LeaveCriticalSection 58937->58938 58938->58935 58939 698391a1 58938->58939 58946 69846b10 58939->58946 58950 69846b64 58946->58950 58947 69846f19 InterlockedCompareExchange 58949 698391f3 58947->58949 58949->58935 59017 69839840 58949->59017 58950->58947 59032 69852e20 58950->59032 58952 69846edd 58952->58947 58953 69846f12 SafeArrayDestroy 58952->58953 58953->58947 58954 69846bc2 58954->58947 58954->58952 59035 698528c0 InterlockedCompareExchange 58954->59035 58956 69846c6b 58956->58947 58956->58952 58957 69846c7e SafeArrayGetLBound 58956->58957 58957->58952 58958 69846c99 SafeArrayGetUBound 58957->58958 58958->58952 58959 69846cb4 SafeArrayAccessData 58958->58959 58959->58952 58960 69846cd5 58959->58960 59036 69845760 67 API calls std::tr1::_Xweak 58960->59036 58962 69846cf5 SafeArrayUnaccessData 58962->58952 58963 69846d07 58962->58963 58963->58952 59037 69831690 77 API calls 58963->59037 58965 69846d2c 58966 69889bb5 77 API calls 58965->58966 58967 69846d3f 58966->58967 58968 69835050 77 API calls 58967->58968 58969 69846d59 58968->58969 58970 69889bb5 77 API calls 58969->58970 58971 69846d63 58970->58971 58972 69835050 77 API calls 58971->58972 58973 69846d7f 58972->58973 58974 69889bb5 77 API calls 58973->58974 58975 69846d86 58974->58975 58976 69835050 77 API calls 58975->58976 58977 69846da0 58976->58977 59038 698350c0 77 API calls 58977->59038 58979 69846dab 58980 69889bb5 77 API calls 58979->58980 58981 69846db2 58980->58981 58982 69835050 77 API calls 58981->58982 58983 69846dcf 58982->58983 59039 698350c0 77 API calls 58983->59039 58985 69846dda 58986 69889bb5 77 API calls 58985->58986 58987 69846de7 58986->58987 58988 69835050 77 API calls 58987->58988 58989 69846e01 58988->58989 59040 698350c0 77 API calls 58989->59040 58991 69846e0c 58992 69889bb5 77 API calls 58991->58992 58993 69846e19 58992->58993 58994 69835050 77 API calls 58993->58994 58995 69846e33 58994->58995 58996 69889bb5 77 API calls 58995->58996 58997 69846e3a 58996->58997 58998 69835050 77 API calls 58997->58998 58999 69846e58 58998->58999 59000 69889bb5 77 API calls 58999->59000 59001 69846e5f 59000->59001 59002 69835050 77 API calls 59001->59002 59003 69846e79 59002->59003 59041 698350c0 77 API calls 59003->59041 59005 69846e84 59042 698350c0 77 API calls 59005->59042 59007 69846e8f 59008 69889bb5 77 API calls 59007->59008 59009 69846e9b 59008->59009 59010 69835050 77 API calls 59009->59010 59011 69846eb5 59010->59011 59043 698350c0 77 API calls 59011->59043 59013 69846ec0 59044 698350c0 77 API calls 59013->59044 59015 69846ecb 59045 69832a40 327 API calls 59015->59045 59018 69889bb5 77 API calls 59017->59018 59019 69839865 59018->59019 59020 69839227 59019->59020 59046 69889533 66 API calls std::exception::_Copy_str 59019->59046 59025 69837140 59020->59025 59022 698398ab 59047 6988ac75 RaiseException 59022->59047 59024 698398c0 59048 69852820 59025->59048 59027 6983719c 59030 698371d7 59027->59030 59053 6988919e 67 API calls 3 library calls 59027->59053 59028 698371f8 59028->58884 59030->59028 59054 69889d2c 66 API calls 2 library calls 59030->59054 59033 69852e67 59032->59033 59033->58954 59034 69852e9f InterlockedCompareExchange 59033->59034 59034->58954 59035->58956 59036->58962 59037->58965 59038->58979 59039->58985 59040->58991 59041->59005 59042->59007 59043->59013 59044->59015 59045->58952 59046->59022 59047->59024 59049 69852845 59048->59049 59050 698528af 59049->59050 59051 69889d66 _malloc 66 API calls 59049->59051 59050->59027 59052 69852876 59051->59052 59052->59027 59053->59030 59054->59028 59056 69889bb5 77 API calls 59055->59056 59057 6983632b 59056->59057 59058 69889bb5 77 API calls 59057->59058 59059 69836350 59058->59059 59060 69835050 77 API calls 59059->59060 59061 6983636e 59060->59061 59062 69889bb5 77 API calls 59061->59062 59063 69836375 59062->59063 59064 69835050 77 API calls 59063->59064 59065 69836392 59064->59065 59066 69889bb5 77 API calls 59065->59066 59067 69836399 59066->59067 59068 69835050 77 API calls 59067->59068 59069 698363b3 59068->59069 59070 69889bb5 77 API calls 59069->59070 59071 698363c9 59070->59071 59072 698363d4 59071->59072 59073 69836459 59071->59073 59075 698316b0 327 API calls 59072->59075 59080 69889533 66 API calls std::exception::_Copy_str 59073->59080 59079 69836402 _Fac_tidy 59075->59079 59076 6983646b 59081 6988ac75 RaiseException 59076->59081 59078 69836482 59079->58888 59080->59076 59081->59078 59083 69838bd5 EnterCriticalSection 59082->59083 59084 69838bcc 59082->59084 59092 6984e030 59083->59092 59084->58892 59088 69838c13 LeaveCriticalSection 59088->58892 59093 6984e090 59092->59093 59094 6984e05d 59092->59094 59095 69889bb5 77 API calls 59093->59095 59096 69889bb5 77 API calls 59094->59096 59097 69838bec 59094->59097 59095->59097 59096->59097 59098 6983b6c0 GetModuleHandleW 59097->59098 59099 6983b717 LoadLibraryW 59098->59099 59100 6983b72a GetProcAddress 59098->59100 59099->59100 59101 6983b94c 59099->59101 59100->59101 59104 6983b73e 59100->59104 59102 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59101->59102 59103 69838bfa 59102->59103 59103->59088 59111 69838c40 59103->59111 59104->59101 59105 6983b85d 59104->59105 59125 6988a116 80 API calls __mbstowcs_s_l 59105->59125 59107 6983b875 GetModuleHandleW 59107->59101 59108 6983b8aa GetProcAddress 59107->59108 59108->59101 59110 6983b8f2 59108->59110 59110->59101 59126 6983a350 VariantInit VariantInit VariantInit 59111->59126 59112 69838c63 59113 69838cf9 59112->59113 59136 69838b10 EnterCriticalSection 59112->59136 59113->59088 59115 69838c83 59117 69838c9f 59115->59117 59119 69838ce2 59115->59119 59145 6983b9a0 59115->59145 59153 6983bab0 59117->59153 59119->59088 59120 69838cd3 59120->59119 59169 69838ff0 69 API calls std::tr1::_Xweak 59120->59169 59125->59107 59129 6983a3b5 59126->59129 59127 6983a505 VariantClear VariantClear VariantClear 59130 6983a52a 59127->59130 59128 6983a3e0 VariantCopy 59131 6983a3f9 59128->59131 59132 6983a3ff VariantClear 59128->59132 59129->59127 59129->59128 59130->59112 59131->59132 59133 6983a413 59132->59133 59133->59127 59134 6983a549 VariantClear VariantClear VariantClear 59133->59134 59135 6983a57a 59134->59135 59135->59112 59137 69838b4b 59136->59137 59139 69889bb5 77 API calls 59137->59139 59144 69838b53 LeaveCriticalSection 59137->59144 59140 69838b64 59139->59140 59141 69838b80 59140->59141 59170 69837370 79 API calls 2 library calls 59140->59170 59171 698396d0 77 API calls 59141->59171 59144->59115 59146 6983b9dc 59145->59146 59147 6983ba7a 59146->59147 59148 69889bb5 77 API calls 59146->59148 59147->59117 59149 6983ba3a 59148->59149 59150 6983ba6a 59149->59150 59216 69845f00 77 API calls 2 library calls 59149->59216 59172 69846fd0 59150->59172 59241 6984b580 59153->59241 59155 6983baf3 59156 69838cbd 59155->59156 59246 6983af30 VariantInit VariantInit VariantInit 59155->59246 59156->59119 59160 69838d60 EnterCriticalSection 59156->59160 59158 6983bb0d 59158->59156 59159 69889bb5 77 API calls 59158->59159 59159->59156 59267 69839750 59160->59267 59163 69838d97 59164 69838e0a 59163->59164 59165 69838de5 59163->59165 59269 6983bdf7 59163->59269 59164->59120 59279 69838e20 59165->59279 59167 69838e02 59167->59120 59169->59119 59170->59141 59171->59144 59175 6984700a 59172->59175 59215 698478c2 59172->59215 59173 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59174 69848326 59173->59174 59174->59147 59175->59215 59217 6983d920 59175->59217 59177 698478b5 59178 6983d920 3 API calls 59177->59178 59177->59215 59179 69847920 59178->59179 59180 6983d920 3 API calls 59179->59180 59179->59215 59181 69847986 59180->59181 59182 6983d920 3 API calls 59181->59182 59183 698479df 59181->59183 59182->59183 59183->59215 59225 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59183->59225 59185 69847a7b 59185->59215 59226 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59185->59226 59187 69847acb 59187->59215 59227 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59187->59227 59189 69847b19 59189->59215 59228 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59189->59228 59191 69847b90 59191->59215 59229 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59191->59229 59193 69847c0b 59193->59215 59230 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59193->59230 59195 69847ca5 59195->59215 59231 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59195->59231 59197 69847d3f 59197->59215 59232 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59197->59232 59199 69847dbb 59199->59215 59233 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59199->59233 59201 69847e44 59201->59215 59234 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59201->59234 59203 69847eb5 59203->59215 59235 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59203->59235 59205 69847f6e 59205->59215 59236 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59205->59236 59207 69848081 59207->59215 59237 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59207->59237 59209 698480ca 59209->59215 59238 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59209->59238 59211 698480f9 59211->59215 59239 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59211->59239 59213 69848175 59213->59215 59240 6983d9f0 SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy 59213->59240 59215->59173 59216->59150 59218 6983d936 59217->59218 59219 6983d944 SafeArrayCreateVector 59217->59219 59218->59219 59220 6983d981 59219->59220 59221 6983d95a 59219->59221 59223 6983d9d5 59220->59223 59224 6983d9ce SafeArrayDestroy 59220->59224 59221->59220 59222 6983d960 SafeArrayPutElement 59221->59222 59222->59220 59222->59221 59223->59177 59224->59223 59225->59185 59226->59187 59227->59189 59228->59191 59229->59193 59230->59195 59231->59197 59232->59199 59233->59201 59234->59203 59235->59205 59236->59207 59237->59209 59238->59211 59239->59213 59240->59215 59242 6984b5b5 59241->59242 59243 6984b5cb VariantInit VariantInit 59241->59243 59242->59155 59244 6984b5ee 59243->59244 59245 6984b675 VariantClear VariantClear 59244->59245 59245->59155 59249 6983af97 59246->59249 59247 6983b22c VariantClear VariantClear VariantClear 59248 6983b254 59247->59248 59248->59158 59249->59247 59250 6983affe VariantCopy 59249->59250 59251 6983b017 59250->59251 59252 6983b01d VariantClear 59250->59252 59251->59252 59253 6983b035 59252->59253 59253->59247 59254 69889bb5 77 API calls 59253->59254 59255 6983b0ae 59254->59255 59266 6988a136 66 API calls __cftoe_l 59255->59266 59257 6983b108 59258 6983b190 SafeArrayGetLBound SafeArrayGetUBound 59257->59258 59259 6983b28d VariantClear VariantClear VariantClear 59257->59259 59263 6983b1fd _Fac_tidy 59257->59263 59261 6983b28b 59258->59261 59262 6983b1bf SafeArrayAccessData 59258->59262 59260 6983b2ba 59259->59260 59260->59158 59261->59259 59262->59261 59264 6983b1d3 _memmove 59262->59264 59263->59247 59265 6983b1eb SafeArrayUnaccessData 59264->59265 59265->59261 59265->59263 59266->59257 59268 69838d88 LeaveCriticalSection 59267->59268 59268->59163 59268->59164 59270 6983be01 59269->59270 59271 6983be2c SafeArrayDestroy 59270->59271 59272 6983be33 59270->59272 59271->59272 59274 6983be6a IsBadReadPtr 59272->59274 59277 6983be77 59272->59277 59278 6983befd _Fac_tidy 59272->59278 59273 6983af30 92 API calls 59273->59278 59274->59277 59275 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59276 6983c00f 59275->59276 59276->59165 59277->59273 59278->59275 59280 69838e39 59279->59280 59281 69838e7c EnterCriticalSection 59280->59281 59287 69838f7f _Fac_tidy 59280->59287 59282 69838e9e 59281->59282 59283 69838eac LeaveCriticalSection 59282->59283 59284 69838ebd 59283->59284 59283->59287 59285 69889bb5 77 API calls 59284->59285 59286 69838ec4 _memset 59285->59286 59289 6983c020 VariantInit VariantInit VariantInit VariantInit 59286->59289 59287->59167 59292 6983c098 59289->59292 59290 6983c307 VariantClear VariantClear VariantClear VariantClear 59291 6983c336 59290->59291 59291->59287 59292->59290 59297 6983b300 59292->59297 59295 6983c10c 59295->59290 59296 6983c234 59295->59296 59308 6984b6b0 VariantInit VariantInit 59295->59308 59296->59290 59306 6983b364 59297->59306 59298 6983b524 SafeArrayDestroy 59299 6983b52e 59298->59299 59300 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59299->59300 59301 6983b5a1 59300->59301 59301->59295 59302 6983b3e1 SafeArrayGetLBound SafeArrayGetUBound 59304 6983b4be 59302->59304 59302->59306 59303 6983b416 SafeArrayGetElement 59303->59306 59307 6983b3c8 59303->59307 59305 6983b5d8 VariantClear 59304->59305 59304->59307 59305->59307 59306->59302 59306->59303 59306->59304 59306->59307 59307->59298 59307->59299 59310 6984b75a 59308->59310 59309 6984be96 VariantClear VariantClear 59311 6984beb6 59309->59311 59310->59309 59312 6984b7b9 SafeArrayCreateVector 59310->59312 59315 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59311->59315 59313 6984b7e4 59312->59313 59314 6984b7ec SafeArrayPutElement VariantClear 59312->59314 59313->59314 59318 6984b80f 59314->59318 59329 6984b8fa 59314->59329 59317 6984beef 59315->59317 59316 6984be8f SafeArrayDestroy 59316->59309 59317->59296 59319 6984b871 59318->59319 59320 6984b913 59318->59320 59318->59329 59319->59329 59425 6984dbc0 77 API calls 2 library calls 59319->59425 59320->59329 59427 6983dcd0 10 API calls 59320->59427 59323 6984b93f 59323->59329 59428 6983dcd0 10 API calls 59323->59428 59324 6984b8d3 59426 6984c850 75 API calls std::tr1::_Xweak 59324->59426 59327 6984b962 59328 6984b8ef 59327->59328 59327->59329 59429 6983dcd0 10 API calls 59327->59429 59328->59329 59331 6984ba0b VariantClear 59328->59331 59329->59309 59329->59316 59331->59329 59332 6984ba23 59331->59332 59332->59329 59333 69889bb5 77 API calls 59332->59333 59334 6984baa2 59333->59334 59367 6984bf00 VariantInit VariantInit VariantInit VariantInit 59334->59367 59337 6984baeb 59337->59329 59339 6984bb09 59337->59339 59431 698447d0 107 API calls 59337->59431 59339->59329 59384 698449b0 VariantInit VariantInit VariantInit SafeArrayCreateVector 59339->59384 59342 6984bb2c 59342->59329 59396 6984cd20 VariantInit VariantInit VariantInit SafeArrayCreateVector 59342->59396 59344 6984bb49 59344->59329 59408 69844170 VariantInit VariantInit SafeArrayCreateVector 59344->59408 59346 6984bb85 59346->59329 59349 6984bca2 59346->59349 59419 6983c4a0 VariantInit VariantCopy 59346->59419 59348 6984bbdb VariantInit VariantInit SafeArrayCreateVector SafeArrayPutElement VariantClear 59421 6984db10 SafeArrayCreateVector SafeArrayPutElement 59348->59421 59350 6983c4a0 2 API calls 59349->59350 59356 6984bd78 59349->59356 59351 6984bcdd VariantInit VariantInit SafeArrayCreateVector SafeArrayPutElement VariantClear 59350->59351 59357 6984db10 3 API calls 59351->59357 59356->59329 59360 69889bb5 77 API calls 59356->59360 59359 6984bd5d VariantClear VariantClear 59357->59359 59359->59356 59361 6984bdf7 59360->59361 59362 6983c4a0 2 API calls 59361->59362 59363 6984be10 59361->59363 59362->59363 59363->59329 59364 69889bb5 77 API calls 59363->59364 59365 6984be59 59364->59365 59365->59329 59366 6983c4a0 2 API calls 59365->59366 59366->59329 59368 6984bf6c 59367->59368 59432 6984c150 SafeArrayCreateVector 59368->59432 59371 6984c150 6 API calls 59372 6984bfdd 59371->59372 59383 6984c096 59372->59383 59442 6984dc40 59372->59442 59374 6984c10e VariantClear VariantClear VariantClear VariantClear 59375 6988948b __ehhandler$?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 59374->59375 59376 6984baca 59375->59376 59376->59329 59376->59337 59430 698447d0 107 API calls 59376->59430 59377 6984c00c 59457 698444c0 VariantInit VariantInit SafeArrayCreateVector 59377->59457 59380 6984c044 VariantInit VariantCopy 59381 6984c05e 59380->59381 59382 6984c07c VariantInit VariantCopy 59381->59382 59381->59383 59382->59383 59383->59374 59385 69844a30 SafeArrayPutElement VariantClear 59384->59385 59386 69844a28 59384->59386 59389 69844a53 59385->59389 59395 69844b52 59385->59395 59386->59385 59387 69844b65 SafeArrayDestroy 59388 69844b6c VariantClear VariantClear VariantClear 59387->59388 59388->59342 59389->59395 59471 6983db30 VariantInit SafeArrayCreateVector SafeArrayPutElement 59389->59471 59391 69844b39 59391->59395 59475 698456b0 59391->59475 59395->59387 59395->59388 59397 6984cda1 SafeArrayPutElement VariantClear 59396->59397 59398 6984cd99 59396->59398 59401 6984cdc6 59397->59401 59402 6984d292 59397->59402 59398->59397 59399 6984d2a4 SafeArrayDestroy 59400 6984d2ab VariantClear VariantClear VariantClear 59399->59400 59400->59344 59401->59402 59403 6983db30 5 API calls 59401->59403 59402->59399 59402->59400 59404 6984d279 59403->59404 59404->59402 59405 698456b0 83 API calls 59404->59405 59406 6984d288 59405->59406 59407 69846880 9 API calls 59406->59407 59407->59402 59409 698441e4 59408->59409 59410 698441ec SafeArrayPutElement VariantClear 59408->59410 59409->59410 59411 69844460 59410->59411 59415 6984420f 59410->59415 59412 69844473 VariantClear VariantClear 59411->59412 59413 6984446c SafeArrayDestroy 59411->59413 59414 69844493 59412->59414 59413->59412 59414->59346 59415->59411 59416 69844455 59415->59416 59493 6988919e 67 API calls 3 library calls 59415->59493 59490 6984ddb0 59416->59490 59420 6983c4b9 59419->59420 59420->59348 59424 6984db4f 59421->59424 59422 6984dba1 SafeArrayDestroy 59423 6984bc60 VariantClear VariantClear 59422->59423 59423->59349 59424->59422 59424->59423 59425->59324 59426->59328 59427->59323 59428->59327 59429->59328 59430->59337 59431->59339 59433 6984c191 59432->59433 59434 6984c1d9 59432->59434 59433->59434 59435 6984c1af SafeArrayPutElement VariantClear 59433->59435 59436 6984c239 59434->59436 59439 6984c20c VariantCopy 59434->59439 59435->59433 59435->59436 59437 6984bfb9 59436->59437 59438 6984c23d SafeArrayDestroy 59436->59438 59437->59371 59437->59383 59438->59437 59440 6984c225 59439->59440 59441 6984c22b VariantClear 59439->59441 59440->59441 59441->59436 59443 6984dc4d 59442->59443 59444 69889bb5 77 API calls 59443->59444 59445 6984dc85 59444->59445 59446 6984dc8c 59445->59446 59447 69889533 std::exception::exception 66 API calls 59445->59447 59446->59377 59448 6984dcca 59447->59448 59449 6988ac75 __CxxThrowException@8 RaiseException 59448->59449 59450 6984dcdf 59449->59450 59451 6984dd23 59450->59451 59452 69889bb5 77 API calls 59450->59452 59451->59377 59453 6984dcf8 59452->59453 59453->59451 59454 69889533 std::exception::exception 66 API calls 59453->59454 59455 6984dd0e 59454->59455 59456 6988ac75 __CxxThrowException@8 RaiseException 59455->59456 59456->59451 59458 69844542 SafeArrayPutElement VariantClear 59457->59458 59459 6984453a 59457->59459 59460 6984476c 59458->59460 59461 6984456a SafeArrayCreateVector SafeArrayPutElement 59458->59461 59459->59458 59462 69844776 SafeArrayDestroy 59460->59462 59463 6984477d VariantClear VariantClear 59460->59463 59461->59460 59464 6984459e SafeArrayPutElement 59461->59464 59462->59463 59465 6984479d 59463->59465 59464->59460 59466 698445bf SafeArrayPutElement 59464->59466 59465->59380 59465->59383 59466->59460 59467 698445d8 59466->59467 59467->59460 59468 6984475f 59467->59468 59469 6988919e std::tr1::_Xweak 67 API calls 59467->59469 59470 6984de60 95 API calls 59468->59470 59469->59468 59470->59460 59472 6983db8c 59471->59472 59473 6983dbf0 SafeArrayDestroy 59472->59473 59474 6983dbf7 VariantClear 59472->59474 59473->59474 59474->59391 59476 698456e0 59475->59476 59478 698456f4 59475->59478 59476->59478 59481 698457c0 81 API calls 59476->59481 59477 698457c0 81 API calls 59477->59478 59478->59477 59479 69844b48 59478->59479 59480 6984570d VariantInit VariantCopy 59478->59480 59482 69846880 VariantInit VariantInit 59479->59482 59480->59478 59480->59479 59481->59478 59483 698891e1 59482->59483 59484 698468cd SafeArrayCreateVector SafeArrayPutElement VariantClear 59483->59484 59485 69846913 SafeArrayPutElement 59484->59485 59489 6984692d 59484->59489 59485->59489 59486 69846980 SafeArrayDestroy 59488 69846987 59486->59488 59487 69846994 VariantClear VariantClear 59487->59395 59488->59487 59489->59486 59489->59488 59491 698466a0 107 API calls 59490->59491 59492 6984ddd5 59491->59492 59492->59411 59493->59416 59494->58725 59865 698516af 59866 698516b4 59865->59866 59867 6985170f 59866->59867 59869 69889bb5 77 API calls 59866->59869 59868 69851769 59867->59868 59871 69889bb5 77 API calls 59867->59871 59870 698517c3 59868->59870 59873 69889bb5 77 API calls 59868->59873 59872 698516cd 59869->59872 59876 6985181d 59870->59876 59881 69889bb5 77 API calls 59870->59881 59874 69851727 59871->59874 59875 698516e9 59872->59875 59915 6984ea40 59872->59915 59877 69851781 59873->59877 59878 69851743 59874->59878 59885 6984ea40 78 API calls 59874->59885 59920 69838400 59875->59920 59879 69851877 59876->59879 59886 69889bb5 77 API calls 59876->59886 59883 6985179d 59877->59883 59890 6984ea40 78 API calls 59877->59890 59893 69838400 77 API calls 59878->59893 59884 698518d1 59879->59884 59891 69889bb5 77 API calls 59879->59891 59887 698517db 59881->59887 59897 69838400 77 API calls 59883->59897 59885->59878 59892 69851835 59886->59892 59888 698517f7 59887->59888 59894 6984ea40 78 API calls 59887->59894 59900 69838400 77 API calls 59888->59900 59890->59883 59896 6985188f 59891->59896 59898 69851851 59892->59898 59903 6984ea40 78 API calls 59892->59903 59899 6985175f 59893->59899 59894->59888 59901 698518ab 59896->59901 59907 6984ea40 78 API calls 59896->59907 59902 698517b9 59897->59902 59905 69838400 77 API calls 59898->59905 59929 698380b0 67 API calls _Fac_tidy 59899->59929 59906 69851813 59900->59906 59911 69838400 77 API calls 59901->59911 59930 698380b0 67 API calls _Fac_tidy 59902->59930 59903->59898 59909 6985186d 59905->59909 59931 698380b0 67 API calls _Fac_tidy 59906->59931 59907->59901 59932 698380b0 67 API calls _Fac_tidy 59909->59932 59913 698518c7 59911->59913 59933 698380b0 67 API calls _Fac_tidy 59913->59933 59916 69889bb5 77 API calls 59915->59916 59917 6984ea6b 59916->59917 59918 6984ea7e SysAllocString 59917->59918 59919 6984ea99 59917->59919 59918->59919 59919->59875 59921 69889bb5 77 API calls 59920->59921 59922 6983840d 59921->59922 59924 69838416 59922->59924 59934 69889533 66 API calls std::exception::_Copy_str 59922->59934 59928 698380b0 67 API calls _Fac_tidy 59924->59928 59925 6983844e 59935 6988ac75 RaiseException 59925->59935 59927 69838463 59928->59867 59929->59868 59930->59870 59931->59876 59932->59879 59933->59884 59934->59925 59935->59927 59936 5abccd0 59937 5abccf3 59936->59937 59944 5b90eb3 59937->59944 59949 5b90f14 59937->59949 59938 5abcd0b 59954 5b926f8 59938->59954 59971 5b926dc 59938->59971 59939 5abcd4d 59946 5b90eb8 59944->59946 59945 5b919c1 59945->59938 59946->59945 59988 5abcd69 59946->59988 59992 5abcd70 59946->59992 59950 5b90f15 59949->59950 59951 5b919c1 59950->59951 59952 5abcd69 327 API calls 59950->59952 59953 5abcd70 327 API calls 59950->59953 59951->59938 59952->59951 59953->59951 59955 5b9272b 59954->59955 60039 5abd090 59955->60039 60043 5abd084 59955->60043 59956 5b928de 59958 5b929cb 59956->59958 59961 5abd58b NtUnmapViewOfSection 59956->59961 59962 5abd590 NtUnmapViewOfSection 59956->59962 59957 5b92a0c 59965 5abd68b VirtualAllocEx 59957->59965 59966 5abd690 VirtualAllocEx 59957->59966 59958->59939 59959 5b92a45 59959->59958 59969 5abd7ab WriteProcessMemory 59959->59969 59970 5abd7b0 WriteProcessMemory 59959->59970 59960 5b92b54 59960->59958 59967 5abd7ab WriteProcessMemory 59960->59967 59968 5abd7b0 WriteProcessMemory 59960->59968 59961->59957 59962->59957 59965->59959 59966->59959 59967->59960 59968->59960 59969->59960 59970->59960 59972 5b9272b 59971->59972 59986 5abd090 CreateProcessA 59972->59986 59987 5abd084 CreateProcessA 59972->59987 59973 5b928de 59977 5b929cb 59973->59977 60047 5abd590 59973->60047 60050 5abd58b 59973->60050 59974 5b92a0c 60054 5abd68b 59974->60054 60058 5abd690 59974->60058 59975 5b92a45 59975->59977 60061 5abd7ab 59975->60061 60065 5abd7b0 59975->60065 59976 5b92b54 59976->59977 59980 5abd7ab WriteProcessMemory 59976->59980 59981 5abd7b0 WriteProcessMemory 59976->59981 59977->59939 59980->59976 59981->59976 59986->59973 59987->59973 59989 5abcd6e 59988->59989 59996 69853eb0 59989->59996 59990 5abce04 59990->59945 59993 5abcddb 59992->59993 59995 69853eb0 327 API calls 59993->59995 59994 5abce04 59994->59945 59995->59994 59997 69889bb5 77 API calls 59996->59997 59998 69853f11 59997->59998 59999 69889bb5 77 API calls 59998->59999 60000 69853f36 59999->60000 60001 69835050 77 API calls 60000->60001 60002 69853f50 60001->60002 60003 69889bb5 77 API calls 60002->60003 60004 69853f57 60003->60004 60005 69835050 77 API calls 60004->60005 60006 69853f71 60005->60006 60007 69889bb5 77 API calls 60006->60007 60008 69853f78 60007->60008 60009 69835050 77 API calls 60008->60009 60010 69853f92 60009->60010 60011 69889bb5 77 API calls 60010->60011 60012 69853fab 60011->60012 60013 69854031 60012->60013 60014 69853fb2 60012->60014 60037 69889533 66 API calls std::exception::_Copy_str 60013->60037 60016 698316b0 327 API calls 60014->60016 60021 69853fdc _Fac_tidy 60016->60021 60017 69854047 60038 6988ac75 RaiseException 60017->60038 60019 6985405e 60020 69889bb5 77 API calls 60019->60020 60022 698540b5 60020->60022 60021->59990 60023 69889bb5 77 API calls 60022->60023 60024 698540d8 60023->60024 60025 69835050 77 API calls 60024->60025 60026 698540f2 60025->60026 60027 69889bb5 77 API calls 60026->60027 60028 698540f9 60027->60028 60029 69835050 77 API calls 60028->60029 60030 69854113 60029->60030 60031 69889bb5 77 API calls 60030->60031 60032 6985411a 60031->60032 60033 69835050 77 API calls 60032->60033 60034 69854134 60033->60034 60035 698316b0 327 API calls 60034->60035 60036 69854169 _Fac_tidy 60035->60036 60036->59990 60037->60017 60038->60019 60041 5abd10e CreateProcessA 60039->60041 60042 5abd374 60041->60042 60045 5abd090 60043->60045 60044 5abd2ef CreateProcessA 60046 5abd374 60044->60046 60045->60044 60045->60045 60048 5abd5d8 NtUnmapViewOfSection 60047->60048 60049 5abd62d 60048->60049 60049->59974 60051 5abd590 NtUnmapViewOfSection 60050->60051 60053 5abd62d 60051->60053 60053->59974 60055 5abd690 VirtualAllocEx 60054->60055 60057 5abd74e 60055->60057 60057->59975 60059 5abd6d8 VirtualAllocEx 60058->60059 60060 5abd74e 60059->60060 60060->59975 60062 5abd7b0 WriteProcessMemory 60061->60062 60064 5abd897 60062->60064 60064->59976 60066 5abd800 WriteProcessMemory 60065->60066 60068 5abd897 60066->60068 60068->59976 59495 1a6c2e8 59496 1a6c2ff 59495->59496 59497 1a6c306 59495->59497 59496->59497 59500 5ab49a0 59496->59500 59505 5ab49b0 59496->59505 59502 5ab49b0 59500->59502 59501 5ab49de 59501->59497 59502->59501 59503 5ab4eb8 59502->59503 59509 5ab4f27 59502->59509 59506 5ab49d4 59505->59506 59507 5ab49de 59505->59507 59506->59507 59508 5ab4f27 327 API calls 59506->59508 59507->59497 59508->59507 59510 5ab4f5f 59509->59510 59514 5ab5738 59510->59514 59518 5ab5740 59510->59518 59511 5ab4fd2 59511->59503 59515 5ab5740 59514->59515 59522 69852ed0 59515->59522 59516 5ab57cb 59516->59511 59519 5ab5784 59518->59519 59521 69852ed0 327 API calls 59519->59521 59520 5ab57cb 59520->59511 59521->59520 59523 69852f09 59522->59523 59543 69853006 _Fac_tidy 59522->59543 59524 69889bb5 77 API calls 59523->59524 59525 69852f31 59524->59525 59526 69889bb5 77 API calls 59525->59526 59527 69852f54 59526->59527 59528 69835050 77 API calls 59527->59528 59529 69852f6e 59528->59529 59530 69889bb5 77 API calls 59529->59530 59531 69852f75 59530->59531 59532 69835050 77 API calls 59531->59532 59533 69852f8f 59532->59533 59534 69889bb5 77 API calls 59533->59534 59535 69852f96 59534->59535 59536 69835050 77 API calls 59535->59536 59537 69852fb0 59536->59537 59538 69889bb5 77 API calls 59537->59538 59539 69852fb7 59538->59539 59540 69835050 77 API calls 59539->59540 59541 69852fd1 59540->59541 59542 698316b0 327 API calls 59541->59542 59542->59543 59543->59516

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 6984B6B0 Relevance: 35.2, APIs: 23, Instructions: 669COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 720 6984b6b0-6984b758 VariantInit * 2 721 6984b764-6984b769 720->721 722 6984b75a-6984b75f call 6989c1e0 720->722 723 6984b773-6984b784 721->723 724 6984b76b-6984b770 721->724 722->721 727 6984be96-6984beb4 VariantClear * 2 723->727 728 6984b78a-6984b791 723->728 724->723 729 6984beb6-6984bebb 727->729 730 6984bebe-6984beca 727->730 731 6984b793-6984b798 728->731 732 6984b7b9-6984b7e2 SafeArrayCreateVector 728->732 729->730 733 6984bed4-6984bef2 call 6988948b 730->733 734 6984becc-6984bed1 730->734 735 6984b7a2-6984b7b3 731->735 736 6984b79a-6984b79f 731->736 737 6984b7e4-6984b7e7 732->737 738 6984b7ec-6984b809 SafeArrayPutElement VariantClear 732->738 734->733 735->727 735->732 736->735 737->738 739 6984be85-6984be8d 738->739 740 6984b80f-6984b81d 738->740 739->727 742 6984be8f-6984be90 SafeArrayDestroy 739->742 743 6984b81f-6984b824 call 6989c1e0 740->743 744 6984b829-6984b841 740->744 742->727 743->744 744->739 749 6984b847-6984b853 744->749 749->739 750 6984b859-6984b85e 749->750 750->739 751 6984b864-6984b86b 750->751 752 6984b871-6984b87e 751->752 753 6984b913-6984b917 751->753 756 6984b880-6984b882 752->756 757 6984b888-6984b8f8 call 6984dbc0 call 69845790 call 6984c850 752->757 754 6984b921-6984b941 call 6983dcd0 753->754 755 6984b919-6984b91b 753->755 754->739 762 6984b947-6984b964 call 6983dcd0 754->762 755->739 755->754 756->739 756->757 772 6984b904-6984b90e call 6984e800 757->772 773 6984b8fa-6984b8ff call 6984e800 757->773 762->739 768 6984b96a-6984b96d 762->768 770 6984b993-6984b9bf 768->770 771 6984b96f-6984b98d call 6983dcd0 768->771 776 6984b9c1-6984b9c6 call 6989c1e0 770->776 777 6984b9cb-6984ba1d VariantClear 770->777 771->739 771->770 772->770 783 6984be83 773->783 776->777 777->739 785 6984ba23-6984ba31 777->785 783->739 786 6984ba33-6984ba38 call 6989c1e0 785->786 787 6984ba3d-6984ba8b 785->787 786->787 787->739 790 6984ba91-6984ba95 787->790 790->739 791 6984ba9b-6984baa7 call 69889bb5 790->791 794 6984bab6 791->794 795 6984baa9-6984bab4 791->795 796 6984bab8-6984bacc call 6984bf00 794->796 795->796 796->739 799 6984bad2-6984bada 796->799 800 6984baf3-6984baf8 799->800 801 6984badc-6984baed call 698447d0 799->801 803 6984bb11-6984bb2e call 698449b0 800->803 804 6984bafa-6984bb0b call 698447d0 800->804 801->739 801->800 803->739 810 6984bb34-6984bb4b call 6984cd20 803->810 804->739 804->803 810->739 813 6984bb51-6984bb8e call 69845790 call 69844170 810->813 818 6984bb90-6984bb95 call 6984e800 813->818 819 6984bb9a-6984bba8 call 6984e800 813->819 818->783 824 6984bca2 819->824 825 6984bbae-6984bbc0 819->825 827 6984bca8-6984bcae 824->827 825->824 826 6984bbc6-6984bc5b call 6983c4a0 VariantInit * 2 SafeArrayCreateVector SafeArrayPutElement VariantClear call 6984db10 825->826 840 6984bc60-6984bc75 826->840 829 6984bcb4-6984bcc6 827->829 830 6984bd78-6984bdc8 827->830 829->830 832 6984bccc-6984bd76 call 6983c4a0 VariantInit * 2 SafeArrayCreateVector SafeArrayPutElement VariantClear call 6984db10 VariantClear * 2 829->832 830->783 841 6984bdce-6984bdd7 830->841 832->830 843 6984bc77-6984bc8d 840->843 844 6984bc90-6984bca0 VariantClear * 2 840->844 841->783 845 6984bddd-6984bde4 841->845 843->844 844->827 845->783 847 6984bdea-6984be03 call 69889bb5 845->847 850 6984be05-6984be10 call 6983c4a0 847->850 851 6984be12 847->851 853 6984be14-6984be3c 850->853 851->853 855 6984be3e-6984be50 853->855 856 6984be7f 853->856 855->856 857 6984be52-6984be65 call 69889bb5 855->857 856->783 860 6984be67-6984be6f call 6983c4a0 857->860 861 6984be71 857->861 863 6984be73-6984be7c 860->863 861->863 863->856
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984B73F
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984B748
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984B7BE
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984B7F5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984B801
                                                                                                                                                                                                                                    • Part of subcall function 6984C850: VariantInit.OLEAUT32(?), ref: 6984C88F
                                                                                                                                                                                                                                    • Part of subcall function 6984C850: VariantInit.OLEAUT32(?), ref: 6984C895
                                                                                                                                                                                                                                    • Part of subcall function 6984C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984C8A0
                                                                                                                                                                                                                                    • Part of subcall function 6984C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6984C8D5
                                                                                                                                                                                                                                    • Part of subcall function 6984C850: VariantClear.OLEAUT32(?), ref: 6984C8E1
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984BA15
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984BE90
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984BEA3
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984BEA9
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2012514194-0
                                                                                                                                                                                                                                  • Opcode ID: b3ffd0e509e40b19f4001171f713e3123c3c12586e474d02402365e29f3518c1
                                                                                                                                                                                                                                  • Instruction ID: 68fc286511c251f536bd26dc8938cb3cc96cb941d7d32871cb41ee9f1561f9fe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3ffd0e509e40b19f4001171f713e3123c3c12586e474d02402365e29f3518c1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 82525875900218DFDB10DFA8C980BEEBBB6BF99704F14859DE909AB351DB30A945CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B90EB3 Relevance: 29.6, Strings: 23, Instructions: 800COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 865 5b90eb3-5b90ece 867 5b919bb-5b919bf 865->867 868 5b90ed4-5b90ee6 865->868 869 5b919c1-5b919cd 867->869 870 5b919d2-5b91a58 867->870 874 5b90ee8-5b90f0a 868->874 875 5b90f15-5b90f36 868->875 871 5b91ee8-5b91ef5 869->871 887 5b91a5a-5b91a66 870->887 888 5b91a82 870->888 874->875 879 5b90f3c-5b90f52 874->879 875->879 880 5b90f5e-5b91042 879->880 881 5b90f54-5b90f58 879->881 902 5b9106c 880->902 903 5b91044-5b91050 880->903 881->867 881->880 889 5b91a68-5b91a6e 887->889 890 5b91a70-5b91a76 887->890 891 5b91a88-5b91acd 888->891 893 5b91a80 889->893 890->893 1022 5b91ad0 call 5abcd69 891->1022 1023 5b91ad0 call 5abcd70 891->1023 893->891 896 5b91ad2-5b91adf 898 5b91ae1 896->898 899 5b91ae5-5b91b0e 896->899 898->899 904 5b91c40-5b91c47 899->904 905 5b91b14-5b91b40 899->905 908 5b91072-5b91124 902->908 906 5b9105a-5b91060 903->906 907 5b91052-5b91058 903->907 909 5b91c4d-5b91d4c 904->909 910 5b91d4f-5b91db0 904->910 913 5b91b42 905->913 914 5b91b47-5b91b82 905->914 912 5b9106a 906->912 907->912 929 5b9114e 908->929 930 5b91126-5b91132 908->930 909->910 910->871 912->908 913->914 914->904 932 5b91154-5b9116f 929->932 933 5b9113c-5b91142 930->933 934 5b91134-5b9113a 930->934 938 5b91199 932->938 939 5b91171-5b9117d 932->939 935 5b9114c 933->935 934->935 935->932 943 5b9119f-5b911bd 938->943 940 5b9117f-5b91185 939->940 941 5b91187-5b9118d 939->941 944 5b91197 940->944 941->944 947 5b912db-5b913bf 943->947 948 5b911c3-5b912c3 943->948 944->943 962 5b913e9 947->962 963 5b913c1-5b913cd 947->963 948->947 967 5b913ef-5b91444 962->967 964 5b913cf-5b913d5 963->964 965 5b913d7-5b913dd 963->965 968 5b913e7 964->968 965->968 975 5b9144a-5b91549 967->975 976 5b91562-5b91638 967->976 968->967 975->976 976->867 985 5b9163e-5b91647 976->985 987 5b91649-5b9164c 985->987 988 5b91652-5b91751 985->988 987->988 989 5b9176a-5b91781 987->989 988->989 989->867 994 5b91787-5b91898 989->994 1011 5b9189a-5b9189d 994->1011 1012 5b918a3-5b919a2 994->1012 1011->867 1011->1012 1012->867 1022->896 1023->896
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: HERE$HERE$HERE$HERE$HERE$HERE$HERE$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$p<cq$p<cq$p<cq$p<cq$G{q$G{q$G{q$G{q$G{q
                                                                                                                                                                                                                                  • API String ID: 0-125182453
                                                                                                                                                                                                                                  • Opcode ID: 108f5054738779e1e35a2267f5b8a16bc2410bfc7cd5f0fdbf478d2673be6db2
                                                                                                                                                                                                                                  • Instruction ID: 9d12adb9cf493f1e893f83b8899c9ae9eba5861290be5fd1cdb9c2e064223589
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 108f5054738779e1e35a2267f5b8a16bc2410bfc7cd5f0fdbf478d2673be6db2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E3828574E402298FDB64DF69C994BD9B7B2BB88310F1481E9D40DAB365DB34AE81CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6CA28 Relevance: 7.1, Strings: 5, Instructions: 838COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: (ocq$(ocq$,gq$,gq$Hgq
                                                                                                                                                                                                                                  • API String ID: 0-1029698136
                                                                                                                                                                                                                                  • Opcode ID: 5943612988b2859445e9f3daf1a8f6310f34a736b6438b5486de7345c43563d8
                                                                                                                                                                                                                                  • Instruction ID: 7f61edd87ff4500bce07c75526eb4ccb7194950f921acc3b843b7da7dba34041
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5943612988b2859445e9f3daf1a8f6310f34a736b6438b5486de7345c43563d8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 53628034B00115DFDB14DFA9C888AAEBBBAFF88350B158069E945DB365DB31EC41CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD58B Relevance: 1.6, APIs: 1, Instructions: 82nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtUnmapViewOfSection.NTDLL(?,?), ref: 05ABD61B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: SectionUnmapView
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 498011366-0
                                                                                                                                                                                                                                  • Opcode ID: 53d63182cebed1facd6c81dcb6bbadb59b3c53acef34a0e486897bdd9c4dac08
                                                                                                                                                                                                                                  • Instruction ID: df57932b4f85ea145b6a53089114410d8cc6a23c10191a450ed5fc0dcae3e3ef
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53d63182cebed1facd6c81dcb6bbadb59b3c53acef34a0e486897bdd9c4dac08
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5731AAB9D152589FCB10CFA9E584ADEFBF4BB49310F24902AE419B7310D374AA44CFA4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD590 Relevance: 1.6, APIs: 1, Instructions: 81nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtUnmapViewOfSection.NTDLL(?,?), ref: 05ABD61B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: SectionUnmapView
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 498011366-0
                                                                                                                                                                                                                                  • Opcode ID: 72af113260c04c4480cb90f95cdd1dec1ff8a847d844c934c73736b7a9a7d32d
                                                                                                                                                                                                                                  • Instruction ID: aabde32b16be660684f2250f0ac7e2bf3b496f4f76f74040dc37251c6841d000
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 72af113260c04c4480cb90f95cdd1dec1ff8a847d844c934c73736b7a9a7d32d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F931A9B8D152589FCB10CFA9E584ADEFBF4BB49310F24902AE819B7310D374AA44CF64
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60D60 Relevance: 1.5, Strings: 1, Instructions: 275COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 4'cq
                                                                                                                                                                                                                                  • API String ID: 0-182294849
                                                                                                                                                                                                                                  • Opcode ID: 758ef23dfb6e51bbe4b1660e4d36662c30c8c974815dff0c8aee6e63287abaa6
                                                                                                                                                                                                                                  • Instruction ID: 8166a3d63a43ae190c92d8537893e4eb38b99cce6174e5dd14c5cf52fac4ff91
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 758ef23dfb6e51bbe4b1660e4d36662c30c8c974815dff0c8aee6e63287abaa6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79C1FC70E00619CFDB04DFA9E98469EBBB6FF88300F24C529E905A7354EB349945CF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05AB6939 Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 8hq
                                                                                                                                                                                                                                  • API String ID: 0-4057917415
                                                                                                                                                                                                                                  • Opcode ID: 0c78d18ed5cdf3b055e0b698c893ecb1e27a1b8d04d5f0baa86e8f4c7a631839
                                                                                                                                                                                                                                  • Instruction ID: 7d478dc3b20d3ed252db4fdca8a2f6dc66568a2b334218c26158a0c4310c14a6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0c78d18ed5cdf3b055e0b698c893ecb1e27a1b8d04d5f0baa86e8f4c7a631839
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EF31C6B5D01209AFDB04CFA9D480AEEBBF5FF49310F10906AE911B7360DB709A04CB95
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05AB6940 Relevance: 1.3, Strings: 1, Instructions: 87COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 8hq
                                                                                                                                                                                                                                  • API String ID: 0-4057917415
                                                                                                                                                                                                                                  • Opcode ID: 41fe2cc051b9d4a70c760e3fe8b75e3fb2282f176f21163bd11f7b63825ee8dd
                                                                                                                                                                                                                                  • Instruction ID: c71645f905ce224eaace6e0d546472d4536d03efe69a701ff616472192583ddc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 41fe2cc051b9d4a70c760e3fe8b75e3fb2282f176f21163bd11f7b63825ee8dd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E31A475D01209AFDB04CFA9D480AEEBBF5FF49310F10946AE915B7260DB709A04CB95
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B926F8 Relevance: .5, Instructions: 481COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 4199224ec974d531c8d769640207849aef9860b6ddc8952f740364bad744a6e3
                                                                                                                                                                                                                                  • Instruction ID: 7450dd7c66c888b9832f0c1f46936cd1fad8a82620a0f37127581836768fe880
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4199224ec974d531c8d769640207849aef9860b6ddc8952f740364bad744a6e3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE327074E012299FDB64DFA9C990BEDBBB2BF89300F1081AAD509A7354DB705E85CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A69890 Relevance: .4, Instructions: 403COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: c08d31bccecd8339606b04c2da21512d507ca24d7f1d07d443420d1f3f9baf10
                                                                                                                                                                                                                                  • Instruction ID: 30a80809d04b6a0696df470b9caa53621ae81db1b56b1c8de63dd26a82b6aa62
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c08d31bccecd8339606b04c2da21512d507ca24d7f1d07d443420d1f3f9baf10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A129174E00229CFDB64DF69C984B9DBBB6BF89304F1081AAD509A7365DB309E85CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B926DC Relevance: .2, Instructions: 197COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 7db13cf6bfe0b57b331ccfea8ab79e1a27ea3a9e6e572921081bd170d8d89704
                                                                                                                                                                                                                                  • Instruction ID: 974d68f40f6ac2aca0e48aef1a5798450fe2e7ad1840169c7b4bff9e9bbdc2c3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7db13cf6bfe0b57b331ccfea8ab79e1a27ea3a9e6e572921081bd170d8d89704
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B691A274E012289FDB68DF69C950BDDBBF2BF89300F1481AAD409AB255EB305E85CF51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6A9B8 Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 993b2848bab92b8c6bcdaf52ec828775072243a2e62d2719fe66f31e2b77b0c3
                                                                                                                                                                                                                                  • Instruction ID: 1a00b0666f7c66badf185722628eb56c873e49ff2fcfc3684c563b2d8fccae6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 993b2848bab92b8c6bcdaf52ec828775072243a2e62d2719fe66f31e2b77b0c3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E131C275E05618CBEB28CF6AC9447ADFBBABF89301F14D0AAD809B7255EB704945CF40
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69849357 Relevance: 41.0, APIs: 21, Strings: 1, Instructions: 2492COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 698484BF
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 698484D2
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32 ref: 6984850A
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 698494C1
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 698494D4
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6984950C
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 698497A4
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 698497B7
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 698497F2
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 69843B71
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69843B83
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 69849D5F
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69849D72
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 69849DAF
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayDestroy.OLEAUT32(?), ref: 69843BCF
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6984A1BC
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6984A1CF
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6984A20C
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$Destroy$Element
                                                                                                                                                                                                                                  • String ID: A
                                                                                                                                                                                                                                  • API String ID: 959723449-3554254475
                                                                                                                                                                                                                                  • Opcode ID: b703784c872a0282cbad772ba9a349059ee7cd26a4fafa4932844a2ed0f2de36
                                                                                                                                                                                                                                  • Instruction ID: a0bb204450d0a9d91b7861b82873f7a5b038ec1d3783d26f66c58469bdc43769
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b703784c872a0282cbad772ba9a349059ee7cd26a4fafa4932844a2ed0f2de36
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A9239274A00208DFDB00CFA8C984F9DB7B9BF49704F548998E909AF396DB75E945CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69842970 Relevance: 25.8, APIs: 17, Instructions: 335COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1024 69842970-698429c1 1025 698429c3-698429c8 call 6989c1e0 1024->1025 1026 698429cd-698429d7 1024->1026 1025->1026 1092 698429d8 call 186d170 1026->1092 1093 698429d8 call 186d171 1026->1093 1028 698429da-698429dc 1029 69842d12-69842d18 1028->1029 1030 698429e2-698429e8 1028->1030 1031 69842d21-69842d37 1029->1031 1033 69842d1a-69842d1b SafeArrayDestroy 1029->1033 1030->1031 1032 698429ee-69842a1a SafeArrayGetLBound SafeArrayGetUBound 1030->1032 1032->1029 1034 69842a20-69842a37 SafeArrayGetElement 1032->1034 1033->1031 1034->1029 1035 69842a3d-69842a4d 1034->1035 1035->1025 1036 69842a53-69842a66 1035->1036 1090 69842a67 call 186d170 1036->1090 1091 69842a67 call 186d171 1036->1091 1037 69842a69-69842a6f 1038 69842a75-69842a77 1037->1038 1039 69842d5a-69842d5f 1037->1039 1038->1039 1040 69842a7d-69842a92 call 698438e0 1038->1040 1041 69842c76-69842c78 1039->1041 1046 69842c58-69842c63 1040->1046 1047 69842a98-69842aac 1040->1047 1041->1029 1042 69842c7e-69842c86 1041->1042 1042->1029 1048 69842c65-69842c6a 1046->1048 1049 69842c6d-69842c72 1046->1049 1050 69842ab6-69842acc VariantInit 1047->1050 1051 69842aae-69842ab3 1047->1051 1048->1049 1049->1041 1050->1025 1052 69842ad2-69842ae3 1050->1052 1051->1050 1053 69842ae5-69842ae7 1052->1053 1054 69842ae9-69842aeb 1052->1054 1055 69842aee-69842af2 1053->1055 1054->1055 1056 69842af4-69842af6 1055->1056 1057 69842af8 1055->1057 1058 69842afa-69842b34 1056->1058 1057->1058 1060 69842b3a-69842b50 VariantInit 1058->1060 1061 69842c8b-69842caa VariantClear * 2 1058->1061 1060->1025 1062 69842b56-69842b67 1060->1062 1061->1049 1063 69842cac-69842cb4 1061->1063 1064 69842b6d-69842b6f 1062->1064 1065 69842b69-69842b6b 1062->1065 1063->1049 1066 69842b72-69842b76 1064->1066 1065->1066 1068 69842b7c 1066->1068 1069 69842b78-69842b7a 1066->1069 1070 69842b7e-69842bb8 1068->1070 1069->1070 1072 69842bbe-69842bcb 1070->1072 1073 69842d3a-69842d55 VariantClear * 3 1070->1073 1072->1073 1074 69842bd1-69842bf3 call 69853160 1072->1074 1073->1046 1078 69842cb6-69842cf1 VariantClear * 3 1074->1078 1079 69842bf9-69842c1f VariantClear * 3 1074->1079 1086 69842cf3-69842cf6 1078->1086 1087 69842cfb-69842d06 1078->1087 1080 69842c21-69842c26 1079->1080 1081 69842c29-69842c34 1079->1081 1080->1081 1082 69842c36-69842c3b 1081->1082 1083 69842c3e-69842c4d 1081->1083 1082->1083 1083->1034 1085 69842c53 1083->1085 1085->1029 1086->1087 1088 69842d10 1087->1088 1089 69842d08-69842d0d 1087->1089 1088->1029 1089->1088 1090->1037 1091->1037 1092->1028 1093->1028
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 698429F6
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69842A08
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69842A2F
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69842ABB
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69842B3F
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842C04
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842C0B
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842C12
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842C96
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842C9D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842CD6
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842CDD
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842CE4
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 69842D1B
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842D45
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842D4C
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69842D53
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArraySafe$BoundInit$DestroyElement
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 214056513-0
                                                                                                                                                                                                                                  • Opcode ID: e3853bc4a22d8ae6bcdcd7c33ca431573d80445c92137661579ccb6cc2a6a7aa
                                                                                                                                                                                                                                  • Instruction ID: 93905fc7c0b1e06939c3e5bf29be5088ae117c53cd109d55de0ae55ce65e8097
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e3853bc4a22d8ae6bcdcd7c33ca431573d80445c92137661579ccb6cc2a6a7aa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 47C149716083499FD700CFA8C884A5ABBE9BFD9704F208D5DF595C7260C779E846CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983AF30 Relevance: 24.3, APIs: 16, Instructions: 335COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1094 6983af30-6983af95 VariantInit * 3 1095 6983afa1-6983afa7 1094->1095 1096 6983af97-6983af9c call 6989c1e0 1094->1096 1098 6983afb1-6983afbf 1095->1098 1099 6983afa9-6983afae 1095->1099 1096->1095 1175 6983afc0 call 186d170 1098->1175 1176 6983afc0 call 186d171 1098->1176 1099->1098 1100 6983afc2-6983afc4 1101 6983afca-6983afda call 698438e0 1100->1101 1102 6983b22c-6983b252 VariantClear * 3 1100->1102 1101->1102 1109 6983afe0-6983aff4 1101->1109 1104 6983b254-6983b257 1102->1104 1105 6983b25c-6983b26a 1102->1105 1104->1105 1107 6983b274-6983b288 1105->1107 1108 6983b26c-6983b271 1105->1108 1108->1107 1110 6983aff6-6983aff9 1109->1110 1111 6983affe-6983b015 VariantCopy 1109->1111 1110->1111 1112 6983b017-6983b018 call 6989c1e0 1111->1112 1113 6983b01d-6983b033 VariantClear 1111->1113 1112->1113 1115 6983b035-6983b03a call 6989c1e0 1113->1115 1116 6983b03f-6983b050 1113->1116 1115->1116 1118 6983b052-6983b054 1116->1118 1119 6983b056-6983b058 1116->1119 1120 6983b05b-6983b05f 1118->1120 1119->1120 1121 6983b061-6983b063 1120->1121 1122 6983b065 1120->1122 1123 6983b067-6983b09a 1121->1123 1122->1123 1173 6983b09d call 186d170 1123->1173 1174 6983b09d call 186d171 1123->1174 1124 6983b09f-6983b0a1 1124->1102 1125 6983b0a7-6983b0b3 call 69889bb5 1124->1125 1128 6983b0c1 1125->1128 1129 6983b0b5-6983b0bf 1125->1129 1130 6983b0c3-6983b0ca 1128->1130 1129->1130 1131 6983b0d0-6983b0d9 1130->1131 1131->1131 1132 6983b0db-6983b111 call 698891e1 call 6988a136 1131->1132 1137 6983b113-6983b118 call 6989c1e0 1132->1137 1138 6983b11d-6983b12b 1132->1138 1137->1138 1140 6983b131-6983b133 1138->1140 1141 6983b12d-6983b12f 1138->1141 1142 6983b136-6983b13a 1140->1142 1141->1142 1143 6983b140 1142->1143 1144 6983b13c-6983b13e 1142->1144 1145 6983b142-6983b17e 1143->1145 1144->1145 1147 6983b180-6983b18a 1145->1147 1148 6983b1ff-6983b203 1145->1148 1151 6983b190-6983b1b9 SafeArrayGetLBound SafeArrayGetUBound 1147->1151 1152 6983b28d-6983b2b8 VariantClear * 3 1147->1152 1149 6983b210-6983b215 1148->1149 1150 6983b205-6983b20e call 69889c35 1148->1150 1156 6983b223-6983b229 call 69889b35 1149->1156 1157 6983b217-6983b220 call 69889c35 1149->1157 1150->1149 1158 6983b28b 1151->1158 1159 6983b1bf-6983b1cd SafeArrayAccessData 1151->1159 1154 6983b2c2-6983b2d0 1152->1154 1155 6983b2ba-6983b2bf 1152->1155 1162 6983b2d2-6983b2d7 1154->1162 1163 6983b2da-6983b2ee 1154->1163 1155->1154 1156->1102 1157->1156 1158->1152 1159->1158 1165 6983b1d3-6983b1f7 call 698891e1 call 6988a530 SafeArrayUnaccessData 1159->1165 1162->1163 1165->1158 1172 6983b1fd 1165->1172 1172->1148 1173->1124 1174->1124 1175->1100 1176->1100
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6983AF75
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6983AF7C
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6983AF83
                                                                                                                                                                                                                                  • VariantCopy.OLEAUT32(?,?), ref: 6983B00D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B027
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6983B19C
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6983B1AA
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(?,?), ref: 6983B1C5
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 6983B1E6
                                                                                                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(?), ref: 6983B1EF
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B237
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B23E
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B245
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B29D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B2A4
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983B2AB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArraySafe$Init$BoundData$AccessCopyUnaccess_memmove
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3403836469-0
                                                                                                                                                                                                                                  • Opcode ID: 2b0d27808b00ba84a9585a643c97ed0135c589e91c824002e37b11d0175419a0
                                                                                                                                                                                                                                  • Instruction ID: 0fe5de4f6938c8ca7dc903f309f3683c009522d9e7e13b99c2c59d85909908dd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2b0d27808b00ba84a9585a643c97ed0135c589e91c824002e37b11d0175419a0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4AC15AB26087519FD700DFA9C88492BB7E9FB99304F508E2DF659C7250D731E905CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984D410 Relevance: 24.3, APIs: 16, Instructions: 290COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1177 6984d410-6984d44c 1178 6984d472-6984d4e0 VariantInit * 3 1177->1178 1179 6984d44e-6984d465 1177->1179 1180 6984d4e2-6984d4ea 1178->1180 1181 6984d4ec-6984d4f2 1178->1181 1182 6984d4f6-6984d504 1180->1182 1181->1182 1183 6984d506-6984d50d 1182->1183 1184 6984d51e-6984d527 1182->1184 1187 6984d514-6984d516 1183->1187 1188 6984d50f-6984d512 1183->1188 1185 6984d538-6984d53c 1184->1185 1186 6984d529-6984d530 1184->1186 1191 6984d540-6984d544 1185->1191 1186->1185 1190 6984d532-6984d536 1186->1190 1189 6984d518-6984d51c 1187->1189 1188->1189 1189->1183 1189->1184 1190->1191 1192 6984d704-6984d72f VariantClear * 3 1191->1192 1193 6984d54a-6984d5c0 call 69889d66 SafeArrayCreateVector * 2 SafeArrayAccessData 1191->1193 1195 6984d731-6984d757 1192->1195 1196 6984d76c-6984d783 1192->1196 1201 6984d5c6-6984d5ea call 6988a530 SafeArrayUnaccessData 1193->1201 1202 6984d5c2-6984d5c4 1193->1202 1198 6984d470 1195->1198 1199 6984d75d 1195->1199 1198->1178 1203 6984d5ec-6984d605 SafeArrayPutElement 1201->1203 1202->1203 1205 6984d6e5-6984d6eb 1203->1205 1206 6984d60b-6984d629 1203->1206 1210 6984d6f6-6984d6f8 1205->1210 1211 6984d6ed-6984d6f3 call 69889d2c 1205->1211 1208 6984d633-6984d64f SafeArrayPutElement VariantClear 1206->1208 1209 6984d62b-6984d630 1206->1209 1208->1205 1213 6984d655-6984d664 1208->1213 1209->1208 1214 6984d701 1210->1214 1215 6984d6fa-6984d6fb SafeArrayDestroy 1210->1215 1211->1210 1217 6984d762-6984d767 call 6989c1e0 1213->1217 1218 6984d66a-6984d694 1213->1218 1214->1192 1215->1214 1217->1196 1230 6984d697 call 186d170 1218->1230 1231 6984d697 call 186d171 1218->1231 1220 6984d699-6984d69b 1220->1205 1221 6984d69d-6984d6a9 1220->1221 1221->1205 1222 6984d6ab-6984d6c1 call 6983db30 1221->1222 1222->1205 1225 6984d6c3-6984d6e0 call 698456b0 call 69846880 1222->1225 1225->1205 1230->1220 1231->1220
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984D4B3
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984D4C5
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984D4CC
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 6984D551
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6984D58B
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32 ref: 6984D5A6
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32 ref: 6984D5B8
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayInitSafeVariant$CreateVector$AccessData_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1552365394-0
                                                                                                                                                                                                                                  • Opcode ID: 84e2c2c98f507148831c1a203333b29c68da15460091f9ab6e5c6b07c887ddec
                                                                                                                                                                                                                                  • Instruction ID: 4d95d066bb2c9dd09b6134f8b61c40c6d07ef48c96db2c9cda703244304c41fa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84e2c2c98f507148831c1a203333b29c68da15460091f9ab6e5c6b07c887ddec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4B155766083449FD704CF28C880A5AB7E9FFD9714F14895EE8998B251EB34E905CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984D468 Relevance: 21.2, APIs: 14, Instructions: 226COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1232 6984d468 1233 6984d470-6984d4e0 VariantInit * 3 1232->1233 1235 6984d4e2-6984d4ea 1233->1235 1236 6984d4ec-6984d4f2 1233->1236 1237 6984d4f6-6984d504 1235->1237 1236->1237 1238 6984d506-6984d50d 1237->1238 1239 6984d51e-6984d527 1237->1239 1242 6984d514-6984d516 1238->1242 1243 6984d50f-6984d512 1238->1243 1240 6984d538-6984d53c 1239->1240 1241 6984d529-6984d530 1239->1241 1246 6984d540-6984d544 1240->1246 1241->1240 1245 6984d532-6984d536 1241->1245 1244 6984d518-6984d51c 1242->1244 1243->1244 1244->1238 1244->1239 1245->1246 1247 6984d704-6984d72f VariantClear * 3 1246->1247 1248 6984d54a-6984d5c0 call 69889d66 SafeArrayCreateVector * 2 SafeArrayAccessData 1246->1248 1250 6984d731-6984d757 1247->1250 1251 6984d76c-6984d783 1247->1251 1255 6984d5c6-6984d5ea call 6988a530 SafeArrayUnaccessData 1248->1255 1256 6984d5c2-6984d5c4 1248->1256 1250->1233 1253 6984d75d 1250->1253 1257 6984d5ec-6984d605 SafeArrayPutElement 1255->1257 1256->1257 1259 6984d6e5-6984d6eb 1257->1259 1260 6984d60b-6984d629 1257->1260 1264 6984d6f6-6984d6f8 1259->1264 1265 6984d6ed-6984d6f3 call 69889d2c 1259->1265 1262 6984d633-6984d64f SafeArrayPutElement VariantClear 1260->1262 1263 6984d62b-6984d630 1260->1263 1262->1259 1267 6984d655-6984d664 1262->1267 1263->1262 1268 6984d701 1264->1268 1269 6984d6fa-6984d6fb SafeArrayDestroy 1264->1269 1265->1264 1271 6984d762-6984d767 call 6989c1e0 1267->1271 1272 6984d66a-6984d694 1267->1272 1268->1247 1269->1268 1271->1251 1284 6984d697 call 186d170 1272->1284 1285 6984d697 call 186d171 1272->1285 1274 6984d699-6984d69b 1274->1259 1275 6984d69d-6984d6a9 1274->1275 1275->1259 1276 6984d6ab-6984d6c1 call 6983db30 1275->1276 1276->1259 1279 6984d6c3-6984d6e0 call 698456b0 call 69846880 1276->1279 1279->1259 1284->1274 1285->1274
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984D4B3
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984D4C5
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984D4CC
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 6984D551
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6984D58B
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32 ref: 6984D5A6
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32 ref: 6984D5B8
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984D601
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984D63E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$InitVariant$CreateElementVector$AccessData_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2723946344-0
                                                                                                                                                                                                                                  • Opcode ID: c235945bf8367c00aefdddf77edd60036982c82b6724dcb90617f2def1d50290
                                                                                                                                                                                                                                  • Instruction ID: 157c32f2840a2ab53a7c9283a818246ba4429f3f28930f1e1bdbe8c2eca42161
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c235945bf8367c00aefdddf77edd60036982c82b6724dcb90617f2def1d50290
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D9154B56083059FD704CF28C880A5AB7F9BFC8704F14895EE8998B251EB34F805CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698444C0 Relevance: 19.8, APIs: 13, Instructions: 261COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1286 698444c0-69844538 VariantInit * 2 SafeArrayCreateVector 1287 69844542-69844564 SafeArrayPutElement VariantClear 1286->1287 1288 6984453a-6984453d 1286->1288 1289 6984476f-69844774 1287->1289 1290 6984456a-69844598 SafeArrayCreateVector SafeArrayPutElement 1287->1290 1288->1287 1291 69844776-69844777 SafeArrayDestroy 1289->1291 1292 6984477d-6984479b VariantClear * 2 1289->1292 1290->1289 1293 6984459e-698445b9 SafeArrayPutElement 1290->1293 1291->1292 1294 698447b0-698447c4 1292->1294 1295 6984479d-698447ad 1292->1295 1293->1289 1296 698445bf-698445d2 SafeArrayPutElement 1293->1296 1295->1294 1296->1289 1297 698445d8-698445e3 1296->1297 1298 698445e5-698445ea call 6989c1e0 1297->1298 1299 698445ef-69844604 1297->1299 1298->1299 1299->1289 1302 6984460a-69844615 1299->1302 1302->1289 1303 6984461b-6984469f 1302->1303 1310 698446a1-6984471f 1303->1310 1316 69844721-69844758 1310->1316 1319 6984475f-6984476a call 6984de60 1316->1319 1320 6984475a call 6988919e 1316->1320 1322 6984476c 1319->1322 1320->1319 1322->1289
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698444FF
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69844505
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 69844516
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 69844551
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984455A
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 69844579
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 69844594
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 698445B5
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 698445CE
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 6984475A
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 69844777
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844787
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984478D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$DestroyXweakstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1304965753-0
                                                                                                                                                                                                                                  • Opcode ID: d1b2796113c4245c524c44e229e702848d8dd49d0f4c41f08fcbed8a796801ea
                                                                                                                                                                                                                                  • Instruction ID: 9320c37a8ab0e0bc7874288ac88f4d0948bce96758191e46a4c78a751172fb97
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d1b2796113c4245c524c44e229e702848d8dd49d0f4c41f08fcbed8a796801ea
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CAA12E75A002099BDB14DFA8C984EAFB7F9FF8D710F14462DE506AB785CA34E941CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984BF00 Relevance: 18.2, APIs: 12, Instructions: 215COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1324 6984bf00-6984bf6a VariantInit * 4 1325 6984bf74-6984bf86 1324->1325 1326 6984bf6c-6984bf71 1324->1326 1327 6984bf90-6984bfbb call 6984c150 1325->1327 1328 6984bf88-6984bf8d 1325->1328 1326->1325 1331 6984c0c4-6984c0cd 1327->1331 1332 6984bfc1-6984bfdf call 6984c150 1327->1332 1328->1327 1334 6984c0e2-6984c149 call 6988a1f7 * 2 VariantClear * 4 call 6988948b 1331->1334 1335 6984c0cf-6984c0df 1331->1335 1332->1331 1339 6984bfe5-6984c019 call 6984dc40 1332->1339 1335->1334 1345 6984c020-6984c029 1339->1345 1346 6984c01b-6984c01e 1339->1346 1349 6984c02e 1345->1349 1350 6984c02b-6984c02c 1345->1350 1348 6984c035-6984c037 call 698444c0 1346->1348 1353 6984c03c-6984c03e 1348->1353 1351 6984c030-6984c032 1349->1351 1350->1351 1351->1348 1353->1331 1354 6984c044-6984c05c VariantInit VariantCopy 1353->1354 1356 6984c064-6984c07a 1354->1356 1357 6984c05e-6984c05f call 6989c1e0 1354->1357 1356->1331 1360 6984c07c-6984c094 VariantInit VariantCopy 1356->1360 1357->1356 1361 6984c096-6984c097 call 6989c1e0 1360->1361 1362 6984c09c-6984c0af 1360->1362 1361->1362 1362->1331 1365 6984c0b1-6984c0c0 1362->1365 1365->1331
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Init$Clear$Copy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3833040332-0
                                                                                                                                                                                                                                  • Opcode ID: 15d426c6e71c2efae09a978e70d37441cb354cbfb3611616ba6cc8c643130443
                                                                                                                                                                                                                                  • Instruction ID: 52c72312297cfe2ca4606efdaebd28a9041ccee21b6fbdee8b28dc130e62b057
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15d426c6e71c2efae09a978e70d37441cb354cbfb3611616ba6cc8c643130443
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1F819A71900219AFDF04DFA8C884FEEBBB9FF49704F14895DE905A7241DB35A909CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698464D0 Relevance: 18.2, APIs: 12, Instructions: 159COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1366 698464d0-69846552 VariantInit * 3 SafeArrayCreateVector 1367 69846554-69846559 1366->1367 1368 6984655c-6984657e SafeArrayPutElement VariantClear 1366->1368 1367->1368 1369 69846584-698465a1 1368->1369 1370 69846661-69846663 1368->1370 1371 698465a3-698465a6 1369->1371 1372 698465ab-698465c7 SafeArrayPutElement VariantClear 1369->1372 1373 69846665-69846666 SafeArrayDestroy 1370->1373 1374 6984666c-6984669d VariantClear * 3 1370->1374 1371->1372 1372->1370 1375 698465cd-698465db 1372->1375 1373->1374 1376 698465e7-69846613 1375->1376 1377 698465dd-698465e2 call 6989c1e0 1375->1377 1389 69846616 call 186d170 1376->1389 1390 69846616 call 186d171 1376->1390 1377->1376 1379 69846618-6984661a 1379->1370 1380 6984661c-69846628 1379->1380 1380->1370 1381 6984662a-6984663c call 6983db30 1380->1381 1381->1370 1384 6984663e-69846650 call 698456b0 call 69846880 1381->1384 1388 69846655-6984665c 1384->1388 1388->1370 1389->1379 1390->1379
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984650C
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69846519
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69846520
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C), ref: 69846531
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984656D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846576
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 698465B6
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 698465BF
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69846666
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846677
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984667E
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846685
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1625659656-0
                                                                                                                                                                                                                                  • Opcode ID: 35ba4ef69405aa6a8f45ceea0ffa3658ebe3e360ff554be9b318995552da69d4
                                                                                                                                                                                                                                  • Instruction ID: 61b84b6eeec3498a1002056a9814c22107ad7fdf20526bf8d2973e9f880a670d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35ba4ef69405aa6a8f45ceea0ffa3658ebe3e360ff554be9b318995552da69d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76514A721083459FC701DF68C884A5BBBF8EFD9704F10891EF9558B254DB75E906CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984CB90 Relevance: 18.1, APIs: 12, Instructions: 143COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1391 6984cb90-6984cc11 VariantInit * 2 SafeArrayCreateVector * 2 SafeArrayPutElement 1392 6984cce7-6984cce9 1391->1392 1393 6984cc17-6984cc4b SafeArrayPutElement VariantClear 1391->1393 1394 6984ccf2-6984cd18 VariantClear * 2 1392->1394 1395 6984cceb-6984ccec SafeArrayDestroy 1392->1395 1393->1392 1396 6984cc51-6984cc61 SafeArrayPutElement 1393->1396 1395->1394 1396->1392 1397 6984cc67-6984cc7b SafeArrayPutElement 1396->1397 1397->1392 1398 6984cc7d-6984cc8e 1397->1398 1399 6984cc90-6984cc95 call 6989c1e0 1398->1399 1400 6984cc9a-6984ccc8 1398->1400 1399->1400 1405 6984ccc9 call 186d170 1400->1405 1406 6984ccc9 call 186d171 1400->1406 1402 6984cccb-6984cccd 1402->1392 1403 6984cccf-6984cce1 1402->1403 1403->1392 1404 6984cce3 1403->1404 1404->1392 1405->1402 1406->1402
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984CBCA
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984CBD3
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6984CBE4
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6984CBF6
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984CC0D
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6984CC39
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CC42
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6984CC5D
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6984CC77
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6984CCEC
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CCFC
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CD02
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$Destroy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3548156019-0
                                                                                                                                                                                                                                  • Opcode ID: a6c3eb99d8d3f913c79a52597922db6f2fbccf476ea9a6796efad01ba76a286d
                                                                                                                                                                                                                                  • Instruction ID: 2925299a1f327bc99ffde092a51f2e7e4276664ed0138fcc21adbfbfeeefea93
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a6c3eb99d8d3f913c79a52597922db6f2fbccf476ea9a6796efad01ba76a286d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E5513EB5D04249DFDB00DFA8C884EEEBBB8FF59714F00856EEA15A7241D774A905CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983A350 Relevance: 16.7, APIs: 11, Instructions: 206COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1407 6983a350-6983a3bd VariantInit * 3 call 698438e0 1410 6983a3c3-6983a3d6 1407->1410 1411 6983a505-6983a528 VariantClear * 3 1407->1411 1412 6983a3e0-6983a3f7 VariantCopy 1410->1412 1413 6983a3d8-6983a3dd 1410->1413 1414 6983a532-6983a546 1411->1414 1415 6983a52a-6983a52d 1411->1415 1416 6983a3f9-6983a3fa call 6989c1e0 1412->1416 1417 6983a3ff-6983a411 VariantClear 1412->1417 1413->1412 1415->1414 1416->1417 1419 6983a413-6983a418 call 6989c1e0 1417->1419 1420 6983a41d-6983a42b 1417->1420 1419->1420 1422 6983a431-6983a433 1420->1422 1423 6983a42d-6983a42f 1420->1423 1424 6983a436-6983a43a 1422->1424 1423->1424 1425 6983a440 1424->1425 1426 6983a43c-6983a43e 1424->1426 1427 6983a442-6983a477 1425->1427 1426->1427 1443 6983a47a call 186d170 1427->1443 1444 6983a47a call 186d171 1427->1444 1428 6983a47c-6983a47e 1428->1411 1429 6983a484-6983a493 1428->1429 1430 6983a495-6983a49a call 6989c1e0 1429->1430 1431 6983a49f-6983a4b0 1429->1431 1430->1431 1433 6983a4b2-6983a4b4 1431->1433 1434 6983a4b6-6983a4b8 1431->1434 1435 6983a4bb-6983a4bf 1433->1435 1434->1435 1436 6983a4c1-6983a4c3 1435->1436 1437 6983a4c5 1435->1437 1438 6983a4c7-6983a503 1436->1438 1437->1438 1438->1411 1440 6983a549-6983a578 VariantClear * 3 1438->1440 1441 6983a582-6983a596 1440->1441 1442 6983a57a-6983a57f 1440->1442 1442->1441 1443->1428 1444->1428
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$Init$Copy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3214764494-0
                                                                                                                                                                                                                                  • Opcode ID: 0362cb5675bbf4986c3997d4c3acf9e3d134337211df3cc85aa053013de38588
                                                                                                                                                                                                                                  • Instruction ID: 2607f7b865c62e0d02f6a3216b893da589cb2d28e1c27acefa4cce56327b86c6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0362cb5675bbf4986c3997d4c3acf9e3d134337211df3cc85aa053013de38588
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89715A762083459FDB00DFA9C980A5BB7E8FF99714F40895DF659CB291D731E804CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983B6C0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1445 6983b6c0-6983b715 GetModuleHandleW 1446 6983b717-6983b724 LoadLibraryW 1445->1446 1447 6983b72a-6983b738 GetProcAddress 1445->1447 1446->1447 1448 6983b94c-6983b954 1446->1448 1447->1448 1449 6983b73e-6983b750 1447->1449 1450 6983b956-6983b95b 1448->1450 1451 6983b95e-6983b96a 1448->1451 1449->1448 1455 6983b756-6983b771 1449->1455 1450->1451 1453 6983b974-6983b98f call 6988948b 1451->1453 1454 6983b96c-6983b971 1451->1454 1454->1453 1455->1448 1459 6983b777-6983b788 1455->1459 1459->1448 1461 6983b78e-6983b791 1459->1461 1461->1448 1462 6983b797-6983b7b2 1461->1462 1462->1448 1464 6983b7b8-6983b7c5 1462->1464 1464->1448 1466 6983b7cb-6983b7d0 1464->1466 1467 6983b7d2-6983b7d7 1466->1467 1468 6983b7da-6983b7e7 1466->1468 1467->1468 1469 6983b7ec-6983b7ee 1468->1469 1469->1448 1470 6983b7f4-6983b7f9 1469->1470 1471 6983b805-6983b80a 1470->1471 1472 6983b7fb-6983b800 call 6989c1e0 1470->1472 1474 6983b814-6983b829 1471->1474 1475 6983b80c-6983b811 1471->1475 1472->1471 1474->1448 1477 6983b82f-6983b849 1474->1477 1475->1474 1478 6983b850-6983b85b 1477->1478 1478->1478 1479 6983b85d-6983b8a4 call 6988a116 GetModuleHandleW 1478->1479 1479->1448 1482 6983b8aa-6983b8c1 1479->1482 1483 6983b8c5-6983b8d0 1482->1483 1483->1483 1484 6983b8d2-6983b8f0 GetProcAddress 1483->1484 1484->1448 1485 6983b8f2-6983b8ff call 69825340 1484->1485 1489 6983b900-6983b905 1485->1489 1489->1489 1490 6983b907-6983b90d 1489->1490 1490->1489 1491 6983b90f-6983b912 1490->1491 1492 6983b914-6983b929 1491->1492 1493 6983b93a 1491->1493 1495 6983b931-6983b938 1492->1495 1496 6983b92b-6983b92e 1492->1496 1494 6983b93d-6983b948 call 6983ad80 1493->1494 1494->1448 1495->1494 1496->1495
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(mscoree.dll,3B921FC0), ref: 6983B711
                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(mscoree.dll), ref: 6983B71C
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6983B730
                                                                                                                                                                                                                                  • __cftoe.LIBCMT ref: 6983B870
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(?), ref: 6983B88B
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,C8F5E518), ref: 6983B8D7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc$LibraryLoad__cftoe
                                                                                                                                                                                                                                  • String ID: CLRCreateInstance$mscoree.dll$v4.0.30319
                                                                                                                                                                                                                                  • API String ID: 1275574042-506955582
                                                                                                                                                                                                                                  • Opcode ID: d15c1df947e037680fe52361dce20fd070f16201383041a5e9b9156b4cb3f977
                                                                                                                                                                                                                                  • Instruction ID: 0b7279bfde2c2b51f7128a33c8c3b0172c1271b31a964b0290987f4d55e729fb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d15c1df947e037680fe52361dce20fd070f16201383041a5e9b9156b4cb3f977
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A91AFB1D046599FCB00DFE8C8849ADBBB4FF49310F548A6CE51AEB344D730A906CB94
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984CD20 Relevance: 15.5, APIs: 10, Instructions: 485COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1499 6984cd20-6984cd97 VariantInit * 3 SafeArrayCreateVector 1500 6984cda1-6984cdc0 SafeArrayPutElement VariantClear 1499->1500 1501 6984cd99-6984cd9c 1499->1501 1502 6984cdc6-6984cdd1 1500->1502 1503 6984d2a0-6984d2a2 1500->1503 1501->1500 1506 6984cdd3-6984cdd8 call 6989c1e0 1502->1506 1507 6984cddd-6984cdef 1502->1507 1504 6984d2a4-6984d2a5 SafeArrayDestroy 1503->1504 1505 6984d2ab-6984d2d7 VariantClear * 3 1503->1505 1504->1505 1506->1507 1507->1503 1510 6984cdf5-6984ce01 1507->1510 1510->1503 1511 6984ce07-6984cea4 1510->1511 1519 6984cea6-6984ceb7 1511->1519 1520 6984ceba-6984cf2b 1511->1520 1519->1520 1526 6984cf41-6984d222 1520->1526 1527 6984cf2d-6984cf3e 1520->1527 1562 6984d224-6984d229 call 6989c1e0 1526->1562 1563 6984d22e-6984d25c 1526->1563 1527->1526 1562->1563 1566 6984d29d 1563->1566 1567 6984d25e-6984d269 1563->1567 1566->1503 1567->1566 1568 6984d26b-6984d27b call 6983db30 1567->1568 1568->1566 1571 6984d27d-6984d28d call 698456b0 call 69846880 1568->1571 1575 6984d292-6984d299 1571->1575 1575->1566
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984CD5C
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984CD65
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984CD6B
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984CD76
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984CDAA
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CDB7
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6984D2A5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984D2B5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984D2BB
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984D2C1
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2515392200-0
                                                                                                                                                                                                                                  • Opcode ID: 9475a85caf9666af138f5ce02ce4f1d8da0e323dd83082917efa9b8c712ee146
                                                                                                                                                                                                                                  • Instruction ID: 5b3e0e70d2aa912ae2bb717b05055757f0287bcc04f04a4ce565749432d47010
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9475a85caf9666af138f5ce02ce4f1d8da0e323dd83082917efa9b8c712ee146
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE12F675615705AFCB18DBA8DD84DAAB3B9BF8C700F14466CF50A9BB91CA30F841CB50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698466A0 Relevance: 15.2, APIs: 10, Instructions: 155COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1576 698466a0-69846725 VariantInit * 2 SafeArrayCreateVector 1577 69846727-6984672a 1576->1577 1578 6984672f-6984674f SafeArrayPutElement VariantClear 1576->1578 1577->1578 1579 69846844-69846846 1578->1579 1580 69846755-69846772 1578->1580 1583 6984684f-69846878 VariantClear * 2 1579->1583 1584 69846848-69846849 SafeArrayDestroy 1579->1584 1581 69846774-69846779 1580->1581 1582 6984677c-6984679c SafeArrayPutElement VariantClear 1580->1582 1581->1582 1582->1579 1585 698467a2-698467b0 1582->1585 1584->1583 1586 698467b2-698467b7 call 6989c1e0 1585->1586 1587 698467bc-698467ef 1585->1587 1586->1587 1599 698467f2 call 186d170 1587->1599 1600 698467f2 call 186d171 1587->1600 1589 698467f4-698467f6 1589->1579 1590 698467f8-69846805 1589->1590 1590->1579 1591 69846807-6984681c call 6983db30 1590->1591 1591->1579 1594 6984681e-6984683f call 698456b0 call 69846880 1591->1594 1594->1579 1599->1589 1600->1589
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 698466DB
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 698466EA
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 69846700
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984673A
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846747
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 69846787
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846794
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69846849
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984685A
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846861
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArrayClearSafe$ElementInit$CreateDestroyVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 551789342-0
                                                                                                                                                                                                                                  • Opcode ID: a16defc1769c333f6a002ef04006d245f3a6a38daeb48e8f6622537ccf6fd261
                                                                                                                                                                                                                                  • Instruction ID: 51ceb02e9b747925d6441f437d5c4ce20f58b8547db04099a799eb277e4c8808
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a16defc1769c333f6a002ef04006d245f3a6a38daeb48e8f6622537ccf6fd261
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3A514876108245AFCB00CF64C944A5BBBE9FFD9B14F008A5DF9559B350EB30E905CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984840E Relevance: 13.8, APIs: 9, Instructions: 332COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 1601 6984840e-69848413 call 6989c1e0 1603 69848418-6984841f 1601->1603 1691 69848422 call 186d170 1603->1691 1692 69848422 call 186d171 1603->1692 1604 69848424-69848426 1605 6984ae53-6984ae60 1604->1605 1606 6984842c-69848443 call 6983dfb0 1604->1606 1607 6984ae62-6984ae65 SafeArrayDestroy 1605->1607 1608 6984ae68-6984ae70 1605->1608 1606->1605 1615 69848449-69848454 1606->1615 1607->1608 1610 6984ae72-6984ae75 SafeArrayDestroy 1608->1610 1611 6984ae7b-6984ae83 1608->1611 1610->1611 1613 6984ae85-6984ae88 SafeArrayDestroy 1611->1613 1614 6984ae8e-6984ae96 1611->1614 1613->1614 1618 6984aea1-6984aea9 1614->1618 1619 6984ae98-6984ae9b SafeArrayDestroy 1614->1619 1616 69848464-6984846f 1615->1616 1617 69848456-69848461 1615->1617 1620 69848471-6984847c 1616->1620 1621 6984847f-69848487 1616->1621 1617->1616 1622 6984aeb4-6984aebc 1618->1622 1623 6984aeab-6984aeae SafeArrayDestroy 1618->1623 1619->1618 1620->1621 1626 69848493-698484a9 1621->1626 1627 69848489-6984848e call 6989c1e0 1621->1627 1624 6984aec7-6984aed3 1622->1624 1625 6984aebe-6984aec1 SafeArrayDestroy 1622->1625 1623->1622 1628 6984aed5-6984aeda 1624->1628 1629 6984aedd-6984aef8 call 6988948b 1624->1629 1625->1624 1626->1605 1634 698484af-698484e7 SafeArrayGetLBound SafeArrayGetUBound 1626->1634 1627->1626 1628->1629 1635 69848616-6984862d call 6983dfb0 1634->1635 1636 698484ed-69848512 SafeArrayGetElement 1634->1636 1635->1605 1646 69848633-6984864d call 6983dfb0 1635->1646 1638 69848758-69848761 1636->1638 1639 69848518-69848523 1636->1639 1638->1605 1640 69848767-6984876f 1638->1640 1642 69848525-69848528 1639->1642 1643 6984852d-6984853b 1639->1643 1640->1605 1642->1643 1644 69848545-6984855a 1643->1644 1645 6984853d-69848542 1643->1645 1647 69848564-69848582 call 69843a90 1644->1647 1648 6984855c-69848561 1644->1648 1645->1644 1646->1605 1654 69848653-6984866d call 6983dfb0 1646->1654 1655 69848584-6984858d 1647->1655 1656 6984858f-698485ab call 69843a90 1647->1656 1648->1647 1654->1605 1661 69848673-6984868c call 6983dfb0 1654->1661 1659 698485b6-698485b9 call 6983ad80 1655->1659 1664 698485be-698485f6 call 6988a1f7 * 2 1656->1664 1666 698485ad-698485b0 1656->1666 1659->1664 1661->1605 1670 69848692-698486ac call 6983dfb0 1661->1670 1675 69848600-69848610 1664->1675 1676 698485f8-698485fd 1664->1676 1666->1659 1670->1605 1677 698486b2-698486d1 call 698469c0 1670->1677 1675->1635 1675->1636 1676->1675 1677->1605 1680 698486d7-698486f7 call 698469c0 1677->1680 1680->1605 1683 698486fd-6984870b 1680->1683 1684 69848715-69848753 call 698469c0 call 6988a1f7 1683->1684 1685 6984870d-69848712 1683->1685 1684->1605 1685->1684 1691->1604 1692->1604
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 698484BF
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 698484D2
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32 ref: 6984850A
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 69843B71
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69843B83
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 69846A08
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69846A15
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69846A41
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6983DFF6
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6983E003
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6983E02F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$Destroy$Element
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 959723449-0
                                                                                                                                                                                                                                  • Opcode ID: ae6f29b8aa0f17dc7c283782dd5af6205c956c8b48ab99f2cf90f7f3e6fbfb20
                                                                                                                                                                                                                                  • Instruction ID: 50f5e573540cc109d62402ba50d7c63c5f7dc3bc3735223ce0a19cd6078f21bb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae6f29b8aa0f17dc7c283782dd5af6205c956c8b48ab99f2cf90f7f3e6fbfb20
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 72C16274A052089FDB10CFA8CD84F9DB7B9BF55704F5089ACE919EB286D771E940CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69844170 Relevance: 13.8, APIs: 9, Instructions: 277COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698441AF
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698441B5
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 698441C0
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 698441F5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844201
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 69844450
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984446D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984447D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844483
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1774866819-0
                                                                                                                                                                                                                                  • Opcode ID: 905effb3b745d40d167e1a254b3cc3e3b91d2b44faf916018d54f36b53bdf2dd
                                                                                                                                                                                                                                  • Instruction ID: a2d10733208d160f1205b14983ed96a495d8e40a6754420c406d4b64bfbd5778
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 905effb3b745d40d167e1a254b3cc3e3b91d2b44faf916018d54f36b53bdf2dd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 73B137756006099FCB14DFA8C884DAEB3F9BF8D710F15856CE50AAB791DA34F841CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984C530 Relevance: 13.8, APIs: 9, Instructions: 259COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984C56F
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984C575
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984C580
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6984C5B5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C5C1
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 6984C7D4
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984C7F1
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C801
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C807
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1774866819-0
                                                                                                                                                                                                                                  • Opcode ID: 0aded85de0bae302762f74c5bf00957908a512f9effa7b455858ba34d4838966
                                                                                                                                                                                                                                  • Instruction ID: 95b8e62bdb4fd9938f7af096bbd6015e272404e871c64bd9f959f5b86e4c02d9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0aded85de0bae302762f74c5bf00957908a512f9effa7b455858ba34d4838966
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FA127756006099FCB14DFA8C884EEEB7F9BF8D310F15856DE50AAB791DA34B841CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69846880 Relevance: 13.6, APIs: 9, Instructions: 117COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698468B2
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698468BD
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 698468D7
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 698468FD
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69846909
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 69846923
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69846981
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984699E
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 698469A4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArraySafe$Clear$ElementInit$CreateDestroyVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3529038988-0
                                                                                                                                                                                                                                  • Opcode ID: e1fc22f65e6deaeaeb6e12646a47dd2d09ea75db938e3d55fb4cadc85633b020
                                                                                                                                                                                                                                  • Instruction ID: 0ef3fc246708273771330a385dfa7bc5e1a31e2eb3142d1dff975c31dc54d092
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1fc22f65e6deaeaeb6e12646a47dd2d09ea75db938e3d55fb4cadc85633b020
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 394162B2A00249DFDF00DFA9C844AEEBBB8FF99714F14451DE505A7340E775A905CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983C020 Relevance: 12.3, APIs: 8, Instructions: 309COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ClearInit
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2610073882-0
                                                                                                                                                                                                                                  • Opcode ID: be354a5188cbbe76d30c36363f2b3eecd2ce67be76c9c053421dc46301484779
                                                                                                                                                                                                                                  • Instruction ID: bfe27f307cb49d63a574e18f4a940ad6ef261b4d7028f9da0882bd97cf79c2e1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: be354a5188cbbe76d30c36363f2b3eecd2ce67be76c9c053421dc46301484779
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6EC155756087209FC700DFA8C88091ABBE5BFD9304F648E4DF9998B366D731E845CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69846B10 Relevance: 9.4, APIs: 6, Instructions: 364COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 69846C8B
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 69846CA6
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 69846CC7
                                                                                                                                                                                                                                    • Part of subcall function 69845760: std::tr1::_Xweak.LIBCPMT ref: 69845769
                                                                                                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 69846CF9
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69846F13
                                                                                                                                                                                                                                  • InterlockedCompareExchange.KERNEL32(698CC6A4,45524548,4B4F4F4C), ref: 69846F34
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2722669376-0
                                                                                                                                                                                                                                  • Opcode ID: 617183d5a1c8ea3ad0ab5bca1f0c8f87fe14b878cf5344c571c61b4eee67b29a
                                                                                                                                                                                                                                  • Instruction ID: da78690d13a8bc5ba6eee1a7a6e5fabab1add834aa9080423f37059b99820841
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 617183d5a1c8ea3ad0ab5bca1f0c8f87fe14b878cf5344c571c61b4eee67b29a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37D1B0B5A002089FDB00CFA8C890BAEB7F8BF45704F548C6DE549EB281D775E944CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698316B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 487COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 69831B53
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69831B5D
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69831C43
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69831C58
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • invalid vector<T> subscript, xrefs: 69831B58
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8ThrowXinvalid_argumentXweak_mallocstd::_std::exception::exceptionstd::tr1::_
                                                                                                                                                                                                                                  • String ID: invalid vector<T> subscript
                                                                                                                                                                                                                                  • API String ID: 3098024973-3016609489
                                                                                                                                                                                                                                  • Opcode ID: bef052b9274fd59d8ab4e24c079221dda427d8a2886073a6c7433fce06ed5eee
                                                                                                                                                                                                                                  • Instruction ID: 056c0d3d98a6362e49c062b9c9e75392a3bc953f2d12059cd0e988e7c7f3e956
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bef052b9274fd59d8ab4e24c079221dda427d8a2886073a6c7433fce06ed5eee
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B2239758003199FCB14DFE8C4809DEBBB5BF44314F548A6ED45AAB254E734AA89CBD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983DB30 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(698431EC), ref: 6983DB5E
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6983DB6E
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6983DB82
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6983DBF1
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6983DBFB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Variant$ClearCreateDestroyElementInitVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 182531043-0
                                                                                                                                                                                                                                  • Opcode ID: f7d65a32c1146d153577162c09d4f9ae449ae7e8772c381301f5c90649f351bf
                                                                                                                                                                                                                                  • Instruction ID: a7d982b7f2821ed85cfe437f2b876013b6d444b6e421474d029911caa9d4cf17
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f7d65a32c1146d153577162c09d4f9ae449ae7e8772c381301f5c90649f351bf
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4531717AA04245EFDB00DFA4C944EEEB7F9FF9A710F51855AE911AB340D734A901CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988A42D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: T@12
                                                                                                                                                                                                                                  • String ID: a0
                                                                                                                                                                                                                                  • API String ID: 456891419-3188653782
                                                                                                                                                                                                                                  • Opcode ID: 2fbdbb96852c4c4cef05f4e0412554183e488c291c2a0703db9def4b5286684e
                                                                                                                                                                                                                                  • Instruction ID: 1462758afdff39307470f21885d0d6f32ab4eb6380ccffed61fd656eabb56ada
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2fbdbb96852c4c4cef05f4e0412554183e488c291c2a0703db9def4b5286684e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E9119E70D0125669DF309ABA8F4CF6FBABCAF917A4F00AC1DA425E61C1D768D541CAB0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69889BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __FF_MSGBANNER.LIBCMT ref: 69889D7F
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __NMSG_WRITE.LIBCMT ref: 69889D86
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,69889BD4,69821290,3B921FC0), ref: 69889DAB
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69889C04
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69889C1E
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69889C2F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 615853336-0
                                                                                                                                                                                                                                  • Opcode ID: 57e75df695c363740e09e174f9c1a95b91ba44c660678ba8c8cb80f2ad876b28
                                                                                                                                                                                                                                  • Instruction ID: 4d9057d500900c2984455969ec1c9e9598d2db92072cfaca40d84ae4cb17e8c9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 57e75df695c363740e09e174f9c1a95b91ba44c660678ba8c8cb80f2ad876b28
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A2F02239400919EBDF00EB68CE14AAD7AFCAF92718F404C0DE400A7291EB739A09C6B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69836C60 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 69836C73
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(00000000,69836C3C), ref: 69836C87
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69836C9A
                                                                                                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 69836CA3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Data$AccessCreateUnaccessVector_memmove
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3147195435-0
                                                                                                                                                                                                                                  • Opcode ID: 1473205b213e0cdd76e89dbb23c49b1d430204b2fdc6e25fab87f19c940cb43f
                                                                                                                                                                                                                                  • Instruction ID: 43e60b7327f1793348751ad6a7868597f37136ccf2e1c0d360bc20ab071a95b7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1473205b213e0cdd76e89dbb23c49b1d430204b2fdc6e25fab87f19c940cb43f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F7F03A75204224ABEB119FA5DC89F9B7BACEFD6760F008019FA188B244E671D500CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6E898 Relevance: 5.5, Strings: 3, Instructions: 1756COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: (gq$(gq$d
                                                                                                                                                                                                                                  • API String ID: 0-2293994836
                                                                                                                                                                                                                                  • Opcode ID: 57a01cca167811b51453535628c3a37d7b0e4820f1f792d2fb1b0c797ca76327
                                                                                                                                                                                                                                  • Instruction ID: 9dafcfa11a07f6bb0f815024f0016fa6223701d57573d1b7ff0b9e5783c6cbbc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 57a01cca167811b51453535628c3a37d7b0e4820f1f792d2fb1b0c797ca76327
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A652AD756006068FCB15DF69C88096AFBF6FF88320B15C669E55A9B3A2D730FC45CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69851FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69852206
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69852221
                                                                                                                                                                                                                                    • Part of subcall function 69856480: __CxxThrowException@8.LIBCMT ref: 69856518
                                                                                                                                                                                                                                    • Part of subcall function 69856480: __CxxThrowException@8.LIBCMT ref: 69856558
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw$_mallocstd::exception::exception
                                                                                                                                                                                                                                  • String ID: ILProtector
                                                                                                                                                                                                                                  • API String ID: 84431791-1153028812
                                                                                                                                                                                                                                  • Opcode ID: 93e16431703b933e1823a7d5e6351c66683c77859b02425c2b8e698b4c8270b5
                                                                                                                                                                                                                                  • Instruction ID: 8c45b49417c4a375c945a08b0f9cafefed79ce0640f6daab3db8bec831a7122e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 93e16431703b933e1823a7d5e6351c66683c77859b02425c2b8e698b4c8270b5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89712675905258DFCB14CFA8C984BEEBBB4BB59300F1085AEE41AA7340DB346A45CFA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69839110 Relevance: 5.1, APIs: 4, Instructions: 122COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6983913B
                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6983915C
                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 69839170
                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 69839191
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3168844106-0
                                                                                                                                                                                                                                  • Opcode ID: 5a0b0365e1a25867eaff3c844c4c6ea16eea929c62e3750e9f0b5e2d6d7fdde4
                                                                                                                                                                                                                                  • Instruction ID: e00ccd1410e10dbf9121d4973a4d5b03ce90aaafe17ba1587f8e75fb2e699451
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a0b0365e1a25867eaff3c844c4c6ea16eea929c62e3750e9f0b5e2d6d7fdde4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E6413076900219DFCB04DFA9D9848EEBBB4FF99310B51855ED816AB340DB31EA05CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838E20 Relevance: 4.7, APIs: 3, Instructions: 162COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 69838E89
                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,00000000), ref: 69838EAD
                                                                                                                                                                                                                                  • _memset.LIBCMT ref: 69838ED2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave_memset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3751686142-0
                                                                                                                                                                                                                                  • Opcode ID: 473d7de6084fc3aa7bdff8ae51bb4308643555f6121645198b4f3d417ee46984
                                                                                                                                                                                                                                  • Instruction ID: fa585e9002538d281c67fc24633b5098ebe7a2dfbae8af659e4e29e5cd96d4a1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 473d7de6084fc3aa7bdff8ae51bb4308643555f6121645198b4f3d417ee46984
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F516DB5A00219EFCB44CF98C890E5AB7B6FF89304F50895DE91A8B381DB31E955CBD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983D920 Relevance: 4.6, APIs: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6983D949
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6983D96C
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6983D9CF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3149346722-0
                                                                                                                                                                                                                                  • Opcode ID: 89a3e2788abfa5626aa790de3a3170b45663c3550cbd7d33d89318e3b40e8037
                                                                                                                                                                                                                                  • Instruction ID: 2c57316990899deefa2af159d87fdbce81e89985c45032e36c66e0e82d6ffe16
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 89a3e2788abfa5626aa790de3a3170b45663c3550cbd7d33d89318e3b40e8037
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CB213B75600224AFEB11CFA8C884BAA77E8EF9A750F104459ED459B244D771D902CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984DB10 Relevance: 4.6, APIs: 3, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984DB2D
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6984DB45
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6984DBA2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3149346722-0
                                                                                                                                                                                                                                  • Opcode ID: cb9d914bf667f4db7d6be189950fbcadd89f1dc66e1118f260471ab95d2dcbbe
                                                                                                                                                                                                                                  • Instruction ID: aaec400c516e48f7eb1b1ec881d395fdeed2ed2820a5a90cb7b9952f7a124bd7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cb9d914bf667f4db7d6be189950fbcadd89f1dc66e1118f260471ab95d2dcbbe
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92116075645209AFD700DF69C889F9ABBB8FF5A714F04819DE918DB341D730A911CBE0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69853EB0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69854042
                                                                                                                                                                                                                                    • Part of subcall function 69889533: std::exception::_Copy_str.LIBCMT ref: 6988954E
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69854059
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C04
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C1E
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: __CxxThrowException@8.LIBCMT ref: 69889C2F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8Throw$Copy_strExceptionRaise_mallocstd::exception::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2813683038-0
                                                                                                                                                                                                                                  • Opcode ID: 6450652fbe47dd0c0f9f65189993f02500f958c179fc5d679bc26fe4790cbf9e
                                                                                                                                                                                                                                  • Instruction ID: 6f1ac1c9799c0ef3a24e3d663fc9c79c5ea11307232204aa90e5f0fedfaf415f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6450652fbe47dd0c0f9f65189993f02500f958c179fc5d679bc26fe4790cbf9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37919EB19043149FD700CFA9C841B5AFBF8FF91344F548D6EE419DB290E7B699188BA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983BDF7 Relevance: 3.2, APIs: 2, Instructions: 200COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6983BE2D
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(00000000,00000008,?,?,?), ref: 6983BE6D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroyReadSafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 616443815-0
                                                                                                                                                                                                                                  • Opcode ID: c7946ababc5a4828c0f55d774b772a57063a1bad480c0068c43925ad19b86d22
                                                                                                                                                                                                                                  • Instruction ID: 72747ab4f3be0def06b6caf822315afc0abe1a3930b54382bd79aa120dfba446
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7946ababc5a4828c0f55d774b772a57063a1bad480c0068c43925ad19b86d22
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 127121F1D08AA64EDB21CFB88840679FBB1AF56220F588B5CD9E4972D6C331D442CBD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698362C0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69836466
                                                                                                                                                                                                                                    • Part of subcall function 69889533: std::exception::_Copy_str.LIBCMT ref: 6988954E
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6983647D
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Copy_strExceptionException@8RaiseThrow_mallocstd::exception::_std::exception::exception
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2299493649-0
                                                                                                                                                                                                                                  • Opcode ID: 399334815152cb03d32786779cbb56bc17ddc22911e66ae640e43f50d0cdb5c9
                                                                                                                                                                                                                                  • Instruction ID: b48cc9fc8edc4cd9d4aa927bd8bc307a8d6af3a082d65b0887153bcaa18e7fbe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 399334815152cb03d32786779cbb56bc17ddc22911e66ae640e43f50d0cdb5c9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E45179B19083549FD700CF98C981A4ABBE4FB95740F849D2EF5898B390D376D908CBA3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984D2E0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 6984D3E8
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6984D3FF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw_mallocstd::exception::exception
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4063778783-0
                                                                                                                                                                                                                                  • Opcode ID: 9a9c9d0780d383b4b3b71d983e808e1393295427a7cd4f8a7b4dd9d63e094042
                                                                                                                                                                                                                                  • Instruction ID: bdb4435730b12cc5aeac0a31a314401eec1115ca5abdd2216e789f98c997cd2a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a9c9d0780d383b4b3b71d983e808e1393295427a7cd4f8a7b4dd9d63e094042
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79312A756047059FC704CF28C48099AB7F4BF99714F508A6EF8558B390E735E90ACB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838400 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69838449
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6983845E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw_mallocstd::exception::exception
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4063778783-0
                                                                                                                                                                                                                                  • Opcode ID: c929279a706a94b8560fcbba46df915dff5dca9c2e4d9d9593e410c3d8f31dee
                                                                                                                                                                                                                                  • Instruction ID: 7d1825323b871d7dd89c6319ec97d3c78c08d6efab3c5ad66664f76976351af1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c929279a706a94b8560fcbba46df915dff5dca9c2e4d9d9593e410c3d8f31dee
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D10168795002089FCB08DF54D590C9AB7B5FF65300B54C9ADD91A4B750DB31EA05CB95
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B92278 Relevance: 2.6, Strings: 2, Instructions: 124COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: POcq$TJhq
                                                                                                                                                                                                                                  • API String ID: 0-2579739815
                                                                                                                                                                                                                                  • Opcode ID: 68ac22f038c08a82febb04275e6964f3b4e3389e09ccdf07a27072bdf68d0192
                                                                                                                                                                                                                                  • Instruction ID: c127a17ca91adadba83e4359cd894b5e62e5d1748888fcad51d279ad7080504c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68ac22f038c08a82febb04275e6964f3b4e3389e09ccdf07a27072bdf68d0192
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CD41F674F04205AFCB04DB78D850EAEBBBAEFC4310F1584A9E505DB351DB70AD058B91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B90000 Relevance: 2.6, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: TJhq$Tecq
                                                                                                                                                                                                                                  • API String ID: 0-1580033827
                                                                                                                                                                                                                                  • Opcode ID: 80669488b68969b10c2d082b3228ecbe9c3980f0df6a96a76ac2d4fa920b934a
                                                                                                                                                                                                                                  • Instruction ID: 6c48251d61b63ce13b7deb14da091707f5eecdfe86c7f0f087d1fb9c847a7465
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 80669488b68969b10c2d082b3228ecbe9c3980f0df6a96a76ac2d4fa920b934a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E931D3716093848FCB07A77488687AF7FB5AF87210F1904EED446DB292DA356D09C7A3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838D60 Relevance: 2.6, APIs: 2, Instructions: 78COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,00000000,69838C13,?,69838CD3,?,69838C13,00000000,?,?,69838C13,?,?), ref: 69838D73
                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,69838CD3,?,69838C13,00000000,?,?,69838C13,?,?), ref: 69838D8C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3168844106-0
                                                                                                                                                                                                                                  • Opcode ID: e5c68054d34ce7384022012089ca02549b6c1f718c1f40396df32042e0d1c05d
                                                                                                                                                                                                                                  • Instruction ID: eb653a0ba66f44ea7199ce8150cff06cee70b946e86255be6ad1f6162d0dcb90
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e5c68054d34ce7384022012089ca02549b6c1f718c1f40396df32042e0d1c05d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9421E475200109EFCB04DF99D990DAAB3BAFFC9210B508549F90A87355CB31EE16DBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B90048 Relevance: 2.6, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: TJhq$Tecq
                                                                                                                                                                                                                                  • API String ID: 0-1580033827
                                                                                                                                                                                                                                  • Opcode ID: f4032306f105b2b2eb677b30a58a0befa935f5278acd57e3e6450f12439cb005
                                                                                                                                                                                                                                  • Instruction ID: 284b001059676f8034057b11d760e1880c7ea094448daf110a36db9eeb240bfa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4032306f105b2b2eb677b30a58a0befa935f5278acd57e3e6450f12439cb005
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6611B4757001199FDB15EBA894587BFBAEAFBC9310F100469D506AB380CE715D0987E3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838BC0 Relevance: 2.6, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,69836890,?), ref: 69838BDD
                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 69838C23
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3168844106-0
                                                                                                                                                                                                                                  • Opcode ID: b6600aa3bb50d2f6ea56e0cb9c3262b5ae21f395e13cf593874789466325ac7f
                                                                                                                                                                                                                                  • Instruction ID: 05c92a6143a7aab7c5a13e29c205d57dda697c45c233be1bc8bb2abc5d7628f7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b6600aa3bb50d2f6ea56e0cb9c3262b5ae21f395e13cf593874789466325ac7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F701BC71304114AFCB40DFACC8809AAF3A8FF982007008669E905C7301DB72ED51CBD5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD084 Relevance: 1.8, APIs: 1, Instructions: 301processCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05ABD35F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 963392458-0
                                                                                                                                                                                                                                  • Opcode ID: 2c85912f5343207bc830697c6c6bc4bd090e4162c95447b9d5273cab31f7d27d
                                                                                                                                                                                                                                  • Instruction ID: a2586cc79c3ee9261cb21b487bba48b7398cf04c0553becfcde74d8b670f7e62
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c85912f5343207bc830697c6c6bc4bd090e4162c95447b9d5273cab31f7d27d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9B145B0D04259CFEF10CFA8C845BEEBBF5BB49304F149169E819A7291D7B49981CF81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD090 Relevance: 1.8, APIs: 1, Instructions: 295processCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05ABD35F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 963392458-0
                                                                                                                                                                                                                                  • Opcode ID: f37850431de5b8970c1920e4a01b900a5a96857d50f56c9d32e06876414d16ec
                                                                                                                                                                                                                                  • Instruction ID: 76ccf9430a857efe95048d4cf8b3ed84cb820a80d5ab3db9a2fee9a75eb829f4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f37850431de5b8970c1920e4a01b900a5a96857d50f56c9d32e06876414d16ec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39B134B0D04259CFEF10CFA9C845BEEBBF5BB49304F149169E829A7291D7B49981CF81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984E2CE Relevance: 1.7, APIs: 1, Instructions: 214COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1579825452-0
                                                                                                                                                                                                                                  • Opcode ID: ba8cfca97de9d9340fb70ea8f045ae2f46084ef45735578e4a42bc88980f8e32
                                                                                                                                                                                                                                  • Instruction ID: c9d3322ff258d5da478992a98c24233dbba50f80fbcfacbdb320374041605003
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba8cfca97de9d9340fb70ea8f045ae2f46084ef45735578e4a42bc88980f8e32
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D81B2B19083448FEB20DFA8898172EBBE4BF51744F548D7ED14D8B292D7768844CB93
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD7AB Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05ABD885
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MemoryProcessWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3559483778-0
                                                                                                                                                                                                                                  • Opcode ID: f4fbd8cf8274a20eaed16a2a257a4eabbcd52e8ecf9b996335b4ae8ef1176e9e
                                                                                                                                                                                                                                  • Instruction ID: 90269ee7d682ce1431a45851614488dc62f938521134ec6dde93efc1a4f0bf21
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4fbd8cf8274a20eaed16a2a257a4eabbcd52e8ecf9b996335b4ae8ef1176e9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 294167B5D042589FDF10CFA9D984AEEFBF5BB49310F24902AE818B7210D375A945CFA4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD7B0 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05ABD885
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MemoryProcessWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3559483778-0
                                                                                                                                                                                                                                  • Opcode ID: e1bfece10ad9ff809fe3391357d63536116240931efffbc709c3abf83a374e42
                                                                                                                                                                                                                                  • Instruction ID: c58fbabe4b80ca29d182dad372fa6bcd7567e94d8dc969d34c81dd64bfe53921
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1bfece10ad9ff809fe3391357d63536116240931efffbc709c3abf83a374e42
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B4167B5D042589FDF10CFA9D984ADEFBF5BB49310F24902AE818B7210D375A945CF64
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD68B Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05ABD73C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4275171209-0
                                                                                                                                                                                                                                  • Opcode ID: 4b1857e1d8cfed3acb59fcdcba1d2b0bd0e1d3f346448949385e9425c49f8611
                                                                                                                                                                                                                                  • Instruction ID: 1cbfef05ad4baf91e3a83b74540f4570674a564078329435db8e559f27f95b9f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4b1857e1d8cfed3acb59fcdcba1d2b0bd0e1d3f346448949385e9425c49f8611
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB3177B9D012589FCF10CFA9D984ADEFBB5FB49310F10901AE818B7310D375A941CBA4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05ABD690 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05ABD73C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4275171209-0
                                                                                                                                                                                                                                  • Opcode ID: 70ff2e2eca2ef3d56f44c32f113b25cc6ff64f7f83001391ddb59a338f5548a7
                                                                                                                                                                                                                                  • Instruction ID: 500dbea035cf85ee7dd51fbb3aad3be8df746874b0c428855097b0e278d4b692
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70ff2e2eca2ef3d56f44c32f113b25cc6ff64f7f83001391ddb59a338f5548a7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E33155B9D052589FCF10CFA9D984ADEFBB5BB49310F20901AE818B7310D375A941CBA5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69837140 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69852820: _malloc.LIBCMT ref: 69852871
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 698371D2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xweak_mallocstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4085767713-0
                                                                                                                                                                                                                                  • Opcode ID: 9f11e39f18ad5e921496398d37a8a3d72a78b1183e2e262ac1ae0f504d8c346a
                                                                                                                                                                                                                                  • Instruction ID: 357ead90792954e9af6422910d65a28a76a8a9285bfdd8af7affc0674dc4c48f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f11e39f18ad5e921496398d37a8a3d72a78b1183e2e262ac1ae0f504d8c346a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1317AB5A0464ADFCB10CFA9C980AAFB7B9FF49304B508A5DE81697741D335E905CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05AB5200 Relevance: 1.6, APIs: 1, Instructions: 80libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryW.KERNELBASE(?), ref: 05AB52A2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LibraryLoad
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1029625771-0
                                                                                                                                                                                                                                  • Opcode ID: 6f7fd005638765168ffb74995ba8ebda218a138b9fd34717b9967e2d6a97e143
                                                                                                                                                                                                                                  • Instruction ID: 14039ed76941cfd6cda7a36f18b8044db58afeed772da53f4689c5093c8268d3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f7fd005638765168ffb74995ba8ebda218a138b9fd34717b9967e2d6a97e143
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 133198B4D012499FCF14CFAAD584ADEFBF5AB49310F14902AE818B7221D374A945CFA5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05AB5208 Relevance: 1.6, APIs: 1, Instructions: 78libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryW.KERNELBASE(?), ref: 05AB52A2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2662679704.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5ab0000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LibraryLoad
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1029625771-0
                                                                                                                                                                                                                                  • Opcode ID: ba8a1a51eb13f8702dcf0d70f8643c24ed0dd498c85de1eb351167ff6dd12a4d
                                                                                                                                                                                                                                  • Instruction ID: 896e2f559f43280ac21be279ddcda7e813bc94515d05d806ce462a76c69810a3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba8a1a51eb13f8702dcf0d70f8643c24ed0dd498c85de1eb351167ff6dd12a4d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E93198B4D012499FCF14CFAAD584ADEFBF5BB49310F14906AE818B7221D374A945CFA4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984EA40 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • SysAllocString.OLEAUT32 ref: 6984EA8D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocString_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 959018026-0
                                                                                                                                                                                                                                  • Opcode ID: 15c1049112ea62e0d6621f6ee1926a08911c2f188c36fa976cfe86fc2265c402
                                                                                                                                                                                                                                  • Instruction ID: c1a6db242a36d485b11a19752296ae4e6e376c1c957b1cdc30687d1e33b8429d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15c1049112ea62e0d6621f6ee1926a08911c2f188c36fa976cfe86fc2265c402
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 310180B1904759EBD720CF98C900B6AB7A8FF14B64F10871EE815A7380D7B99900CBD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69889D21 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __EH_prolog3_catch.LIBCMT ref: 6988E8DC
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: H_prolog3_catch_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 529455676-0
                                                                                                                                                                                                                                  • Opcode ID: d78c8a2ec95ff4a51f4a12265efd15d28a66241750353488da20dee5c8001590
                                                                                                                                                                                                                                  • Instruction ID: ffe4073e439a18a79d1ebe3722f9846c951cc7f23f324519819903d4b048bf28
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d78c8a2ec95ff4a51f4a12265efd15d28a66241750353488da20dee5c8001590
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 97D05E355242089BCF41EB9C9609B6D7BA8AB41365F90886DF0087B281DB754E0487B6
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988A510 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___security_init_cookie.LIBCMT ref: 6988A510
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___security_init_cookie
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3657697845-0
                                                                                                                                                                                                                                  • Opcode ID: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
                                                                                                                                                                                                                                  • Instruction ID: 1e42976f988b5fac34d5dc22ffba7f184e97d9dd3565fe0fba8ba24f9b6439b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8DC09B391043089F8F04CF54F540C5E3715EB54234710E52DFC180A6909B31D961E570
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60A6B Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 0u
                                                                                                                                                                                                                                  • API String ID: 0-3203441087
                                                                                                                                                                                                                                  • Opcode ID: c1187c692aa6eb3e45c1f73fdecce21886214bf2b842ba73e7bc9140be76c8d6
                                                                                                                                                                                                                                  • Instruction ID: aa82f0a3a7f0055b9647a18aeb1e85b6ef15291c9c5be5b218d91e6838da47f9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c1187c692aa6eb3e45c1f73fdecce21886214bf2b842ba73e7bc9140be76c8d6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98218C74D04209CFDB04CFA5C6486EEBBBAFF89300F249529E409B3254EB755A84CF61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6C2E8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: Hgq
                                                                                                                                                                                                                                  • API String ID: 0-2103768809
                                                                                                                                                                                                                                  • Opcode ID: 1b75162cd9df8186c3847b23bb832d2f7837145dd1f7f0e513e4e6434f34193a
                                                                                                                                                                                                                                  • Instruction ID: ee7b9fd3d8bb4f9bc9f998bb646d7e448faa48caf88a312d9b6b7376ea9f33f6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b75162cd9df8186c3847b23bb832d2f7837145dd1f7f0e513e4e6434f34193a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA21E434A04208EFDB45AB788C05BBEBB7AFF84310F108466E546DB284DA359F45C791
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60B5A Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 93460dfee522f3870b33ab9546dc7bd5b83038c5aa27b4681379bb2527e8d4a6
                                                                                                                                                                                                                                  • Instruction ID: 4ae0987eb09afcc87bffeb00880b874d5fe035f41045637284b0db22f6dbb28d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 93460dfee522f3870b33ab9546dc7bd5b83038c5aa27b4681379bb2527e8d4a6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F051D674E0020ACFDB04DFA9D944AEEBBB6FF89300F248529E905A7355DB349945CF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60B68 Relevance: .1, Instructions: 143COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 93b601f78ed111c17e1983370bff0909435e9a7447f6b3b49422bc3b2fa247e6
                                                                                                                                                                                                                                  • Instruction ID: c2f2f407d68e9ca17104fb9e4b03e8ad0d745037743f662afec98f2cb90ca08f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 93b601f78ed111c17e1983370bff0909435e9a7447f6b3b49422bc3b2fa247e6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A451B674E0020ACFDB04DFA9D944AEEBBB6FF88300F248525E909A7355DB349985CF51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6B5D8 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 39cbb54d3f4d3b6a7a23a65c143b25b894011371628b171c544ceadf6fa9973c
                                                                                                                                                                                                                                  • Instruction ID: 4211fd20b4e5ed35c807084a7cb70f6e5544c01858e146324ef9ceb71d084c56
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 39cbb54d3f4d3b6a7a23a65c143b25b894011371628b171c544ceadf6fa9973c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C141EFB8E05219CFDB04DFA9D9446EDBBFABF89300F14902AD509B7254DB345A45CF60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6A420 Relevance: .1, Instructions: 78COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 60a983ea635099b06fc8daafbda717267614831ab3528bd70091bca719122d9b
                                                                                                                                                                                                                                  • Instruction ID: 02cd088492c90a683588b91f3ea8b21293721bcbacb1c4eaee17fb254f802cce
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 60a983ea635099b06fc8daafbda717267614831ab3528bd70091bca719122d9b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B1213D70A00118DBDB14EBB8E8586EEBBBAFF88310F545029D506B7385DF309E45CB62
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187D964 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 744c8fb78810562c788c25d301a8a9219df648313212c3d075ca2030f0e547a4
                                                                                                                                                                                                                                  • Instruction ID: 2c28fe0f7cf2ccf810c07f54ac02a22a2f8b04a79551d97428c8db39fd2725c1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 744c8fb78810562c788c25d301a8a9219df648313212c3d075ca2030f0e547a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8521DAB1504244DFDF05DF58D9C0B26BBA6FF84318F24C669D9095B246C336D516CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187DA4C Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 1f55370e3ed49f695e60fcb17385cdc9e37a2c290e72a73407ae26c0b10ada78
                                                                                                                                                                                                                                  • Instruction ID: ccd03cb78b39b7de4539543eec1bfe0f0c377cc9ee132c7c1000bcaff41d67fa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f55370e3ed49f695e60fcb17385cdc9e37a2c290e72a73407ae26c0b10ada78
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F72126B1508344DFDB01EF58D9C0B26FBA5FF84324F24C669E9098B246C336D506C7A1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187D44C Relevance: .1, Instructions: 71COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 330f3b0806ae89dec2815ca5056c1167abf8505b3be68d321b8ab13f4b1f3e69
                                                                                                                                                                                                                                  • Instruction ID: 87da5557316534b8a09458858b203189228088986026654bb15ccb5833d60322
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 330f3b0806ae89dec2815ca5056c1167abf8505b3be68d321b8ab13f4b1f3e69
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 542126B1504244EFDB01DF58D5C4B26BF65EF84318F24C66DD80D8B246C33AE546C661
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6BE10 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 590ef9c8dd5449c76d62c6dd425a014683ddfdad44e23155d5971081c20650eb
                                                                                                                                                                                                                                  • Instruction ID: 76dca0d71aa04cc0f5031976a17ec6741ce857347ea78395bb041ca956780a6f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 590ef9c8dd5449c76d62c6dd425a014683ddfdad44e23155d5971081c20650eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B221B0B4E04219DFCF05CFA9D844AEEBBB9FB49310F14802AEA15A7350D7359951CFA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B90848 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: f287a2b6892fb8b030fd7b82abf86439f162abbdee759fc59b0c0da1a58b1776
                                                                                                                                                                                                                                  • Instruction ID: 7fb878b3cba54d2c6866eeeedcf3031bb9f4190cbed35ce7f1cad68788330cc6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f287a2b6892fb8b030fd7b82abf86439f162abbdee759fc59b0c0da1a58b1776
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F2116D353041448FDB45DB7CD8A8EAA7BF5EF8A22071541AEE50ACF372DA219C05CB62
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187D95F Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: d4debc72d566a432075444213d0986bb668aee8537d1fa8b58e63e6cf4e4d047
                                                                                                                                                                                                                                  • Instruction ID: 203c3c07845cc6d907bec16af9bccd0d59dc3ccc095e25bc1c97e276d1afbd49
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4debc72d566a432075444213d0986bb668aee8537d1fa8b58e63e6cf4e4d047
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8511BE76508280CFDB12DF54D9C4B16FF72FB84314F28C2A9D8494B656C33AD51ACBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187DA47 Relevance: .1, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: eedea354e1f580473d21225093553874deeaf8afd5903a59a74e5cb2e8010670
                                                                                                                                                                                                                                  • Instruction ID: 4d1b39e741e4dc811babdacbdebc246f52761c8d96b4f02316a6a932abb2ba71
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eedea354e1f580473d21225093553874deeaf8afd5903a59a74e5cb2e8010670
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0411D076504280CFDB12CF54D5C4B1ABF61FB84314F24C6A9D8094B656C33AD51ACBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0187D447 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2591043437.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_187d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 5ccc830e23e2a284c931ee2cb5cea2ec1ce756450de644149ff13e3e87f156b1
                                                                                                                                                                                                                                  • Instruction ID: 39c6f0ea517cd65563b26eb04a71813890f33e8542322e4b2828671c9d9e9269
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ccc830e23e2a284c931ee2cb5cea2ec1ce756450de644149ff13e3e87f156b1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4711C176504280DFDB12CF14D5C4B59BF61FB84324F24C6A9D8494B656C33AE54ACB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 05B90868 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2669493890.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_5b90000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: aa6034826739537b0a8faad5087e343fe9b82fe005ae36cad2eede732d9b580e
                                                                                                                                                                                                                                  • Instruction ID: 52891cac0e160c08361e93324aa7df62e3169e509ba69799d026bcd8b128b76d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa6034826739537b0a8faad5087e343fe9b82fe005ae36cad2eede732d9b580e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB014C753100158FDB48EB6DD898D6EBBEAFF8962035140AAF50ACB371DE71EC018B91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6DA60 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 13f5fa5ce402bdbee027ddf0fa40357027f10ce6e35f3a9e6e042c39488401a4
                                                                                                                                                                                                                                  • Instruction ID: 71f4071281069b07c147e129fdb76ae3d37be257a5414709487e8d9471b00cb5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 13f5fa5ce402bdbee027ddf0fa40357027f10ce6e35f3a9e6e042c39488401a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA01B5713047128BC310ABADD454A1EB7AAFFD5360F24493DE9468B340DF75DD018791
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0186D171 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2590836092.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_186d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 98edf8ea6c4f429786bd367e9bb61d6b732d893ad3ab00f0f0b4476b8477672b
                                                                                                                                                                                                                                  • Instruction ID: 9975318584d894784a484b42c1bee3141794fe5009d75b8549cf78923c99fb31
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 98edf8ea6c4f429786bd367e9bb61d6b732d893ad3ab00f0f0b4476b8477672b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EE012B71205708DAE7104F59CCC4767FFACDF40324F18C55AED898A186C3B89940C6B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0186D170 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2590836092.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_186d000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: f76cd6695aec950909b2386e098f508ef8eb6fad15d4a1d43c8aab34e0db25cd
                                                                                                                                                                                                                                  • Instruction ID: 79dcb64dc29e772efb59f68f3a64d90b26881ec8f41cdcba064163ef18815a34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f76cd6695aec950909b2386e098f508ef8eb6fad15d4a1d43c8aab34e0db25cd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40F0C2715053449EE7108B0ADD84B62FFACEB80324F18C55AED484B286C3B99844CAB0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6DEB8 Relevance: .0, Instructions: 26COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 2eabd9e957b6c94221ca416192b6f3fc68fb4058887ff65aa277294970185a85
                                                                                                                                                                                                                                  • Instruction ID: 8aed853598c2d5fc33b0c89d2a5bdc6e50a82eda2875bf79f167d77f386e811a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2eabd9e957b6c94221ca416192b6f3fc68fb4058887ff65aa277294970185a85
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 85F0EC3A010108EFCB4A9F80DA08C95BFAAFB0C320B0A80D5F6084B132C332D561EF51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A68728 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: c0b7ad02b04e4e5af1d75949885b71ad6eea26042bcb071108ead0b0ad2905b7
                                                                                                                                                                                                                                  • Instruction ID: 7911e6b395ed1f82810e2388d0c5b5e3c8195c4e698f838f1b1180e5fedfedd9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0b7ad02b04e4e5af1d75949885b71ad6eea26042bcb071108ead0b0ad2905b7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9D05B3185E308DBC704DF68E4095BDBBBCAB07300F005199990923251DA385964C796
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60A28 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: cb524eb163d7a6e105a92cb04e0683e20d18ed33594be4cb88165e23a4c45b5d
                                                                                                                                                                                                                                  • Instruction ID: 1ba1ed4140c25cb9d02d09e8f834bc3e98a025ebea593c9cbc6f6a5ddb79d304
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cb524eb163d7a6e105a92cb04e0683e20d18ed33594be4cb88165e23a4c45b5d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1FD05E3100E7958EE71327B456093A83FBCEB53259F89059BF18C860A7DB214458CB62
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60838 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 326279a852d3ec70a8a29da703ea4d968f1f84ec71d76a7234be6bfffca5ad56
                                                                                                                                                                                                                                  • Instruction ID: 07e6655e8ac433d72808ed6a2b31e60801a8380962c461f6492fd65a2e26b741
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 326279a852d3ec70a8a29da703ea4d968f1f84ec71d76a7234be6bfffca5ad56
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1D017304193918FDBA79B6495083A87FB8AB03314B59059BE484C6067D3614458CB62
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6DB10 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 06b0173f2b0b35f9d852b478ad192f8838e81606e66bb56caf92f53b17c92d43
                                                                                                                                                                                                                                  • Instruction ID: 2f0a813eee221c03259be323f4366d0ab8074bc5e2e622528f0e32e3aff38336
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06b0173f2b0b35f9d852b478ad192f8838e81606e66bb56caf92f53b17c92d43
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56D01770B0120CABCB40DFB8D50065E7BE9EB85344F2044A9E809C7640ED366F009B91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6C8B0 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 859ae77b94a620e7c580f1b5eab192b8b4e25efa0f0600f676e686fede1bed6d
                                                                                                                                                                                                                                  • Instruction ID: 83fcbc157025f08b435b26bba75b259c0a5bcc8fdc3ae3dfc45d453d05b420f3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 859ae77b94a620e7c580f1b5eab192b8b4e25efa0f0600f676e686fede1bed6d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EDD0C9306403489BDF215B75E9087197ADDAF10771F008026E54586155EB31E454DB50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A6A220 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 33194fcf2189af8fc5a092f652e509686627804960b980cea664b5123e554da8
                                                                                                                                                                                                                                  • Instruction ID: 2f5e7705118437cc0d379b7646beacb2b90fed94ecad3c9d65adbf6d9fb967ad
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 33194fcf2189af8fc5a092f652e509686627804960b980cea664b5123e554da8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ADD0C960048EA489FF3253B8B00D3643F98B31631AF544155D5A41159BE7BA9294CF72
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60A38 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: b049d64640cf7c03352e7cad4c28f4346ae63e7ee95832623af9f22b949f766c
                                                                                                                                                                                                                                  • Instruction ID: efc343c1c3eafbb9f413b8248ea8e44d48e7957189adab4471e6eee8d6ef28bd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b049d64640cf7c03352e7cad4c28f4346ae63e7ee95832623af9f22b949f766c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2AC08C300096088AE62037E8630D3BC36ACA791356F840600B10D000948B7080A4CA66
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01A60848 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2594699270.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_1a60000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 595ae5219a5f0486a01bff21021ff9699c5ac20864c2589673ae3b7c1387d6bd
                                                                                                                                                                                                                                  • Instruction ID: 55457b720a167b3d872d875fcaee0fd2fc30c3af64a06ca216147338c4ad0998
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 595ae5219a5f0486a01bff21021ff9699c5ac20864c2589673ae3b7c1387d6bd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2DC02B3000D604CADAA36B88730C37037BC9301301F480404B30C4001587B08090DFE6
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 6983A0C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 227libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CorBindToRuntimeEx.MSCOREE(v2.0.50727,wks,00000000,698B0634,698B0738,?), ref: 6983A119
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(mscorwks), ref: 6983A145
                                                                                                                                                                                                                                  • __cftoe.LIBCMT ref: 6983A1FB
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(?), ref: 6983A215
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000018), ref: 6983A265
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressBindProcRuntime__cftoe
                                                                                                                                                                                                                                  • String ID: mscorwks$v2.0.50727$wks
                                                                                                                                                                                                                                  • API String ID: 1312202379-2066655427
                                                                                                                                                                                                                                  • Opcode ID: 83f9138b45b9187f8d37e7748883e5ef82db0b26dad44b242eec9462d515d2d8
                                                                                                                                                                                                                                  • Instruction ID: 9acd2417c115074f9dc856d8963fe4f1e6c626991ba61db506781e0c05114d2a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 83f9138b45b9187f8d37e7748883e5ef82db0b26dad44b242eec9462d515d2d8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E919B70D042599FCF04CFE9C98499EBBB4BF59320F608A6DE11AEB344D734A905CB94
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987DBB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75encryptionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,3B921FC0,698A8180,00000000,?), ref: 6987DBFB
                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 6987DC01
                                                                                                                                                                                                                                  • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6987DC15
                                                                                                                                                                                                                                  • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6987DC26
                                                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 6987DC2D
                                                                                                                                                                                                                                    • Part of subcall function 6987D9D0: GetLastError.KERNEL32(00000010,3B921FC0,7508FC30,?,00000000), ref: 6987DA1A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6987DC78
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AcquireContextCryptErrorLast$ExceptionException@8RaiseThrow
                                                                                                                                                                                                                                  • String ID: CryptAcquireContext$Crypto++ RNG
                                                                                                                                                                                                                                  • API String ID: 3279666080-1159690233
                                                                                                                                                                                                                                  • Opcode ID: 7440909e40379cbf46d9631b845e38fcdb73235197ec7ed0d8bb0b5195ae5103
                                                                                                                                                                                                                                  • Instruction ID: bc44b92a4ba05ce6827b91ee255528455145198a76f5f1d0bb01eeaf430c675b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7440909e40379cbf46d9631b845e38fcdb73235197ec7ed0d8bb0b5195ae5103
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C21A471258340ABE710DB28CC45F5F7BE8AB99754F440D1EF6419A2C4EBB9A404CBA5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69875DD0 Relevance: 6.4, APIs: 4, Instructions: 390COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: d83c95e35f083ca3bef5b4743f5cb2e1981c1a5e261be12dd667aafffd31af89
                                                                                                                                                                                                                                  • Instruction ID: 60387a7053dba9dcb0a559d3e4e17006cb88d148a6f49cf31649666691ab2307
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d83c95e35f083ca3bef5b4743f5cb2e1981c1a5e261be12dd667aafffd31af89
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB02A170418794CFC754CFAAC8A053EBBE1EBDA311F41091EE5F697291D334A558CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987D9D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(00000010,3B921FC0,7508FC30,?,00000000), ref: 6987DA1A
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLastXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: operation failed with error $OS_Rng:
                                                                                                                                                                                                                                  • API String ID: 406877150-700108173
                                                                                                                                                                                                                                  • Opcode ID: 98eefd70ba55ee9cfef2d0007771438e94622b2e706487f1fd591312e45e598c
                                                                                                                                                                                                                                  • Instruction ID: 55bfc174ff6af3540d33f3d0ec8caf903bb551ac878fd778f901bc0338c7b648
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 98eefd70ba55ee9cfef2d0007771438e94622b2e706487f1fd591312e45e598c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE415CB59083809FD320CF69C841B5BBBE8BB99744F548E2EE18D87241DB799444CBA3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987DD20 Relevance: 1.6, APIs: 1, Instructions: 66encryptionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6989F0E6,000000FF,6987DF67,00000000,?), ref: 6987DDB4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ContextCryptRelease
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 829835001-0
                                                                                                                                                                                                                                  • Opcode ID: 26f61d1a1e746d04883601610dd90bd9e02b068db019d57288212743de77931b
                                                                                                                                                                                                                                  • Instruction ID: 60b8ed5f3583244b25f7af645ec96118a44c6bf529e94316930bf6a90898eec6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 26f61d1a1e746d04883601610dd90bd9e02b068db019d57288212743de77931b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 171193B16087909BEB20CF688985B5A7BE8FB15794F440D2EED15D7380EB79D804CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698884B0 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 0451d5b1e30f0acf6e6cf75832caee7a2d32b07915dc2252f958b44b2c7f5aee
                                                                                                                                                                                                                                  • Instruction ID: 7a488e12c8caeefda450296c67d8018d3060f44e299000e8cce7d78f715cabd3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0451d5b1e30f0acf6e6cf75832caee7a2d32b07915dc2252f958b44b2c7f5aee
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 66115E72A08609EFC704CF59D941799FBF4FB45724F10866EE81993B80E735A900CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69896FB1 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • operator+.LIBCMT ref: 69896FCC
                                                                                                                                                                                                                                    • Part of subcall function 69894147: DName::DName.LIBCMT ref: 6989415A
                                                                                                                                                                                                                                    • Part of subcall function 69894147: DName::operator+.LIBCMT ref: 69894161
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NameName::Name::operator+operator+
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2937105810-0
                                                                                                                                                                                                                                  • Opcode ID: b3a25309cd92ac164717d7b5c6f1eec29e577919cd0aef34f546fb9e443e05cd
                                                                                                                                                                                                                                  • Instruction ID: 8fb994bcf6b5b436b9b3ecd2b659017c37a8a67314ff2c8d1ce9255a372e395c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3a25309cd92ac164717d7b5c6f1eec29e577919cd0aef34f546fb9e443e05cd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7AD11E75920209AFDF11DFACC991AEEBBF4EF19304F00985EE515E7290EB349A45CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988EC9D Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ECA5
                                                                                                                                                                                                                                  • __mtterm.LIBCMT ref: 6988ECB1
                                                                                                                                                                                                                                    • Part of subcall function 6988E97C: DecodePointer.KERNEL32(00000012,6988A397,6988A37D,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988E98D
                                                                                                                                                                                                                                    • Part of subcall function 6988E97C: TlsFree.KERNEL32(0000000C,6988A397,6988A37D,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988E9A7
                                                                                                                                                                                                                                    • Part of subcall function 6988E97C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6988A397,6988A37D,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 69892325
                                                                                                                                                                                                                                    • Part of subcall function 6988E97C: DeleteCriticalSection.KERNEL32(0000000C,?,?,6988A397,6988A37D,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6989234F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6988ECC7
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6988ECD4
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6988ECE1
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6988ECEE
                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED3E
                                                                                                                                                                                                                                  • TlsSetValue.KERNEL32(00000000,?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED59
                                                                                                                                                                                                                                  • __init_pointers.LIBCMT ref: 6988ED63
                                                                                                                                                                                                                                  • EncodePointer.KERNEL32(?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED74
                                                                                                                                                                                                                                  • EncodePointer.KERNEL32(?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED81
                                                                                                                                                                                                                                  • EncodePointer.KERNEL32(?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED8E
                                                                                                                                                                                                                                  • EncodePointer.KERNEL32(?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988ED9B
                                                                                                                                                                                                                                  • DecodePointer.KERNEL32(Function_0006EB00,?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988EDBC
                                                                                                                                                                                                                                  • __calloc_crt.LIBCMT ref: 6988EDD1
                                                                                                                                                                                                                                  • DecodePointer.KERNEL32(00000000,?,?,6988A2D4,698B95C0,00000008,6988A468,?,?,?,698B95E0,0000000C,6988A523,?), ref: 6988EDEB
                                                                                                                                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 6988EDFD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
                                                                                                                                                                                                                                  • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                                                                                                                                  • API String ID: 1868149495-3819984048
                                                                                                                                                                                                                                  • Opcode ID: 1d438a5438ac40cec616a01a0044ca8e2035dbc2660c862f0bb36e5180417897
                                                                                                                                                                                                                                  • Instruction ID: 17350d7b6ee0dfe0e4ae98dc5e142ea7eeebc5f12e47abd1767ab42591dff4fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1d438a5438ac40cec616a01a0044ca8e2035dbc2660c862f0bb36e5180417897
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 91315A71804395DADF10AF79EE0A62A7BE5FB967607140D2EE820D3296EB75C041CFE4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69830EA0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove$Xinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: invalid string position$string too long
                                                                                                                                                                                                                                  • API String ID: 1771113911-4289949731
                                                                                                                                                                                                                                  • Opcode ID: 5e16b8944594c9ca6e34529fb5b2a8da9b702e6100bd765b0410825d00f87b42
                                                                                                                                                                                                                                  • Instruction ID: dd9a9d38a27b8e3f49b969b6572871f39d6f289c681478c92870da47a11df916
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e16b8944594c9ca6e34529fb5b2a8da9b702e6100bd765b0410825d00f87b42
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4CB17271714158ABDB18CE9CCCA0AAE73A6EB85B547944E1CF992CB781C734EC41CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983F95E Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 332COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6983FA0F
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6983FA22
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32 ref: 6983FA5A
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 69843B71
                                                                                                                                                                                                                                    • Part of subcall function 69843A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69843B83
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 69846A08
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69846A15
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69846A41
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6983DFF6
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6983E003
                                                                                                                                                                                                                                    • Part of subcall function 6983DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6983E02F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$Destroy$Element
                                                                                                                                                                                                                                  • String ID: RS7m$RS{m
                                                                                                                                                                                                                                  • API String ID: 959723449-144615663
                                                                                                                                                                                                                                  • Opcode ID: ae6f29b8aa0f17dc7c283782dd5af6205c956c8b48ab99f2cf90f7f3e6fbfb20
                                                                                                                                                                                                                                  • Instruction ID: baa7d4822dc62ce67aba7d8d1cee6827a2b1c4cc4a318c4bb5202cb9cd5fdf86
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae6f29b8aa0f17dc7c283782dd5af6205c956c8b48ab99f2cf90f7f3e6fbfb20
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6EC16F74A042089FEB00CFA8CD84F9DB7B9BF94708F50899CE905EB296D775E941CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984D880 Relevance: 18.2, APIs: 12, Instructions: 202COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984D8EC
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32 ref: 6984D902
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984D90D
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6984D929
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6984D966
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984D973
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6984D9B4
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984D9C1
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984DA6F
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984DA80
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984DA87
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984DA99
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1625659656-0
                                                                                                                                                                                                                                  • Opcode ID: 0e648023b41481a6cf687abb4cfeaec76df2d2214812b5d638d0edbba23da561
                                                                                                                                                                                                                                  • Instruction ID: 9bed0bea0d125c1db28673c0e613d3ee796d29a3aadf260b03573775e0797c7e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0e648023b41481a6cf687abb4cfeaec76df2d2214812b5d638d0edbba23da561
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 318147762083459FC700CF68C884B5AB7E8FFD9714F048A5EE9948B344EB34E905CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69844BA0 Relevance: 15.5, APIs: 10, Instructions: 475COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69844BDC
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69844BE5
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69844BEB
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 69844BF6
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 69844C2A
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844C37
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69845107
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69845117
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984511D
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69845123
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2515392200-0
                                                                                                                                                                                                                                  • Opcode ID: ba77365e501a86cd61750f65e0437eddbbc993cc9f06c7b7db3c4460de6a6ce8
                                                                                                                                                                                                                                  • Instruction ID: 5e7d1469b9e0fe5645e354e7f211b6000dd83cb10372ac716f4a9515c704e4c2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba77365e501a86cd61750f65e0437eddbbc993cc9f06c7b7db3c4460de6a6ce8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9712E475615705ABCB18DBA8DD84DAEB3B9BF8D700F14466CF50A9BB91CA30F841CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698449B0 Relevance: 15.2, APIs: 10, Instructions: 174COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(698A05A8), ref: 698449EE
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698449F7
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 698449FD
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 69844A08
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 69844A39
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844A45
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69844B66
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844B76
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844B7C
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(698A05A8), ref: 69844B82
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2515392200-0
                                                                                                                                                                                                                                  • Opcode ID: 9b1b872a788108978df147c847e421517765f94504261fc60c816352c69d3fbc
                                                                                                                                                                                                                                  • Instruction ID: 575491049a1fdc4a6b03796b2a9cc836b23c27b41cfff7bb1888e416a8a47d48
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9b1b872a788108978df147c847e421517765f94504261fc60c816352c69d3fbc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45516D76A00219AFDB04DFA4CC84EAEB7B8FF99714F04456DE915EB244DB35E901CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698447D0 Relevance: 15.2, APIs: 10, Instructions: 168COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984480C
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69844815
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984481B
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 69844826
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,000000FF,?), ref: 6984485B
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844868
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 69844974
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844984
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984498A
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69844990
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2515392200-0
                                                                                                                                                                                                                                  • Opcode ID: 779b936555e85506ebcc5deac53895b5d081c0e9f881be8b31af18f5c501525e
                                                                                                                                                                                                                                  • Instruction ID: c5dd0e6da05dee33b0fa339eaff92f4924299838660fa061b500735548b9ed36
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 779b936555e85506ebcc5deac53895b5d081c0e9f881be8b31af18f5c501525e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6517B76904249EFDB04DFA8CC80EAEBBB9FF99714F14456DE505EB250DB30A901CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6985C1B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 6985C213
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: gfff$gfff$gfff$gfff$gfff$gfff$vector<T> too long
                                                                                                                                                                                                                                  • API String ID: 1823113695-1254974138
                                                                                                                                                                                                                                  • Opcode ID: f506d207d18f9cd52bea2fecf5da04a3aafb89fc69ac2db7273561b04ebdf4f5
                                                                                                                                                                                                                                  • Instruction ID: ec3079cd8299aa26969f1617db5ac172ea2505263e3330a4b685b73ce8cfc735
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f506d207d18f9cd52bea2fecf5da04a3aafb89fc69ac2db7273561b04ebdf4f5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8F916475A00209AFCB18CF5DDD90EAAB7B9EB98314F04C61DE95ADB740D730BA14CB91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69830CD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$_memmove
                                                                                                                                                                                                                                  • String ID: invalid string position$string too long
                                                                                                                                                                                                                                  • API String ID: 2168136238-4289949731
                                                                                                                                                                                                                                  • Opcode ID: e67a0f1b04027cf1c1cbf739feb330a6f66d7850b8779107da6f01a1a435f51b
                                                                                                                                                                                                                                  • Instruction ID: 5ee8cae8517062a7e5015ef455742a1c623ad4ede14795388fa1bd6d91a983a8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e67a0f1b04027cf1c1cbf739feb330a6f66d7850b8779107da6f01a1a435f51b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D51D4327001249BD724CE9CD980A5EB3EAEBC5750BA08F2EE955CB385DB70EC4187E1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69851B20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 69851C5E
                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 69851C69
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,F1F2E532), ref: 69851CA2
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 69851CC1
                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(kernel32.dll,?,00000000), ref: 69851CCC
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,EFF3E52B), ref: 69851D0A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                                                                  • String ID: User32.dll$kernel32.dll
                                                                                                                                                                                                                                  • API String ID: 310444273-1965990335
                                                                                                                                                                                                                                  • Opcode ID: 3579a077f6167255fc993f166a27cb632994a6b1c6075e659482f508f8cfd1d4
                                                                                                                                                                                                                                  • Instruction ID: b2ed3838de01eb880a2789cf4815cc7b068a06e18d155bbfcb70245817a40625
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3579a077f6167255fc993f166a27cb632994a6b1c6075e659482f508f8cfd1d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 54611978104A049FD7A0CF18C6C1A6ABBF2FB55700FA08D5CD4978BB46D736E85ACB84
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69894409 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • UnDecorator::getArgumentList.LIBCMT ref: 6989442E
                                                                                                                                                                                                                                    • Part of subcall function 69893FC9: Replicator::operator[].LIBCMT ref: 6989404C
                                                                                                                                                                                                                                    • Part of subcall function 69893FC9: DName::operator+=.LIBCMT ref: 69894054
                                                                                                                                                                                                                                  • DName::operator+.LIBCMT ref: 69894487
                                                                                                                                                                                                                                  • DName::DName.LIBCMT ref: 698944DF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
                                                                                                                                                                                                                                  • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                                                                                                                                                                                                                  • API String ID: 834187326-2211150622
                                                                                                                                                                                                                                  • Opcode ID: e324b61f4389d3903701c8096268adcbfb8df89fdb2392dd26ea6bcc2eb22782
                                                                                                                                                                                                                                  • Instruction ID: f5b7dff6621e47e01e52c53662ad7dfb9f140b2f72a11db4ab93da291a043266
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e324b61f4389d3903701c8096268adcbfb8df89fdb2392dd26ea6bcc2eb22782
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA217FB5611158EFCF01CFACC540AA97BF4EBB6389B00999DE855DB212C730D907DB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69895D36 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • UnDecorator::UScore.LIBCMT ref: 69895D40
                                                                                                                                                                                                                                  • DName::DName.LIBCMT ref: 69895D4C
                                                                                                                                                                                                                                    • Part of subcall function 69893B3B: DName::doPchar.LIBCMT ref: 69893B6C
                                                                                                                                                                                                                                  • UnDecorator::getScopedName.LIBCMT ref: 69895D8B
                                                                                                                                                                                                                                  • DName::operator+=.LIBCMT ref: 69895D95
                                                                                                                                                                                                                                  • DName::operator+=.LIBCMT ref: 69895DA4
                                                                                                                                                                                                                                  • DName::operator+=.LIBCMT ref: 69895DB0
                                                                                                                                                                                                                                  • DName::operator+=.LIBCMT ref: 69895DBD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
                                                                                                                                                                                                                                  • String ID: void
                                                                                                                                                                                                                                  • API String ID: 1480779885-3531332078
                                                                                                                                                                                                                                  • Opcode ID: 3a4054e77bbbc8d8b67fe4b587c45b3add4712c336b7118eabc6e915a1aef5b9
                                                                                                                                                                                                                                  • Instruction ID: c23f81d8c58fbd3812b34bcca1d6772a7a89b1cc75d0ed4aee7f3e1ea3eb5cc6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3a4054e77bbbc8d8b67fe4b587c45b3add4712c336b7118eabc6e915a1aef5b9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA11A975920348AFDB05DB6CC89CFAD7BB0AB51305F4088ADE859EB291DB709E46CB40
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984C850 Relevance: 13.8, APIs: 9, Instructions: 271COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984C88F
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 6984C895
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984C8A0
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6984C8D5
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C8E1
                                                                                                                                                                                                                                  • std::tr1::_Xweak.LIBCPMT ref: 6984CB1C
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984CB39
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CB49
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984CB4F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1774866819-0
                                                                                                                                                                                                                                  • Opcode ID: 53847feea1a8942bf1d065ddb25817bb2141a55b86198aeec9f8e34653663126
                                                                                                                                                                                                                                  • Instruction ID: 2f5ab080a490dc8912885fdcd1aff7b81214eaf8998928f7a2f0ca6fedaee807
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53847feea1a8942bf1d065ddb25817bb2141a55b86198aeec9f8e34653663126
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12B12675600649AFCB14DFA8C884DEEB7F9BF8D310F14856DE50AAB791DA34B841CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698842B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 698842DD
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69884363
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69884381
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 698843E6
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69884453
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69884474
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: vector<T> too long
                                                                                                                                                                                                                                  • API String ID: 4034224661-3788999226
                                                                                                                                                                                                                                  • Opcode ID: da66776ed9c127119f21c45a5424428dde6629eec6cf9cd7bd7d9243da8aa779
                                                                                                                                                                                                                                  • Instruction ID: 12e797b3cbf5b6d11303633254084b872b9500519d9c16ba0340dd394c3e033b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: da66776ed9c127119f21c45a5424428dde6629eec6cf9cd7bd7d9243da8aa779
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9518FB66042069FC718CF78DE85D6BB7E9EBD4214F188E2DE986C3344E671E904C7A1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69854B60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$_memmove
                                                                                                                                                                                                                                  • String ID: invalid string position$string too long
                                                                                                                                                                                                                                  • API String ID: 2168136238-4289949731
                                                                                                                                                                                                                                  • Opcode ID: e7e47b5ca72d9dec3f3a6a2c8cbdb8be5929813cc3ca8376e69a1f1cfa40a658
                                                                                                                                                                                                                                  • Instruction ID: 9d57fde81ec126f5198e0906f98437afc41527594ffaa54a0d45deb26c3f908b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e7e47b5ca72d9dec3f3a6a2c8cbdb8be5929813cc3ca8376e69a1f1cfa40a658
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0341C3327042108BD364CE7DD980A2EF3EAEBE5754B600E1EE193C7680C7759CAD8362
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840815 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RSUa
                                                                                                                                                                                                                                  • API String ID: 4225690600-2086061799
                                                                                                                                                                                                                                  • Opcode ID: eeff2948bdb24e8f42c3d63306f8f2329cee58b7a1ac30501db15521a55cde8e
                                                                                                                                                                                                                                  • Instruction ID: d11e9fbb5f6376ed7008e70550689d5542bb43c47a6611f36e1978efd1dad181
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eeff2948bdb24e8f42c3d63306f8f2329cee58b7a1ac30501db15521a55cde8e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB314970E046189FDB00CFA9CD80B5EB7B9AF99710F20898AE418E7255DB75ED81CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984012D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RS:h
                                                                                                                                                                                                                                  • API String ID: 4225690600-3891202347
                                                                                                                                                                                                                                  • Opcode ID: 0902711525d9e2b2381ad99aed90b2aa58b122f93072f9ddd1496ec335963dd0
                                                                                                                                                                                                                                  • Instruction ID: 11d989f34fe8a708f33c621d409aa9fa02e89ace06b29076baee03304cd15fbb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0902711525d9e2b2381ad99aed90b2aa58b122f93072f9ddd1496ec335963dd0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83314A70E046089FDB00DF68CD80B5EB7B9AF99610F20899AE418E7255C775E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840237 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RS3g
                                                                                                                                                                                                                                  • API String ID: 4225690600-2794631155
                                                                                                                                                                                                                                  • Opcode ID: b0fa8265a5cdc7f7932725bba2be1074143002d2712edca8bee89d9a095c3cdd
                                                                                                                                                                                                                                  • Instruction ID: acdf89fce5e3c566d21bc04440c53f269e8b05f1c9f5022afde67ea6fdb10940
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b0fa8265a5cdc7f7932725bba2be1074143002d2712edca8bee89d9a095c3cdd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1313C74E046189FCB00CFA9CD80B5EB7B9AF99710F208A9AE418E7295DB75ED41CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840787 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RSa
                                                                                                                                                                                                                                  • API String ID: 4225690600-3169278968
                                                                                                                                                                                                                                  • Opcode ID: 029c3f48e79248822aa5bccc2f0e5ddc997a929bc9a54095e240c6e09c37f6a7
                                                                                                                                                                                                                                  • Instruction ID: a022f5fef7e53ea7459af39bae376ddb70f0986dad53743f54b26b8e02558b95
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 029c3f48e79248822aa5bccc2f0e5ddc997a929bc9a54095e240c6e09c37f6a7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 27315974A046189FCB00DFA9CD80B5EB7B9AF99710F20898AE419E7256CB75ED41CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698406F9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RSqb
                                                                                                                                                                                                                                  • API String ID: 4225690600-347567867
                                                                                                                                                                                                                                  • Opcode ID: 84f802e25616212085b13b06b8f862cfc4c0c0625809db3a8f33b7945ecc399a
                                                                                                                                                                                                                                  • Instruction ID: afa2e5f11167d64bbf34e037bc06fdee16c2dd77bad0f717dc8315131208cf06
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84f802e25616212085b13b06b8f862cfc4c0c0625809db3a8f33b7945ecc399a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 25315974E046189FCB00CFA9CD80B9EB7B9AF99710F20898AE419E7255DB75ED81CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987C760 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • type_info::operator!=.LIBCMT ref: 6987C7EB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: type_info::operator!=
                                                                                                                                                                                                                                  • String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent
                                                                                                                                                                                                                                  • API String ID: 2241493438-339133643
                                                                                                                                                                                                                                  • Opcode ID: 8107db35e75479f07ab0ffaa9f3658dc0a9d62edde5b764399c11c168f033c01
                                                                                                                                                                                                                                  • Instruction ID: f3ec9ffc31423b2181389330cd5c2e2d9087fcc1cdfe09dae5a5e5afc44147b0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8107db35e75479f07ab0ffaa9f3658dc0a9d62edde5b764399c11c168f033c01
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A5314775A143449EC710DF7C8985A4EBBE1AFD5248F459E2EF4459F320EB719848CB82
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840457 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID: RS%e
                                                                                                                                                                                                                                  • API String ID: 4225690600-1409579784
                                                                                                                                                                                                                                  • Opcode ID: fff1a39e3d7d09cd1a6496cb2a4caa8181498210d5e6d77cb1ac122a6fd8974e
                                                                                                                                                                                                                                  • Instruction ID: 9de3107547c7160e7ffc175cc44c0844f5f6ed92638de1c10566dcb97eb33046
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fff1a39e3d7d09cd1a6496cb2a4caa8181498210d5e6d77cb1ac122a6fd8974e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F0314970A046189FCB10CFA9CC80BADB7BABF95710F20899EE418E7256C775D941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983AA00 Relevance: 12.3, APIs: 8, Instructions: 309COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ClearInit
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2610073882-0
                                                                                                                                                                                                                                  • Opcode ID: 92c6385937ce34e89bd0cc7f83ea8e28bc61e47f82b79eefdecfbc72e9487f3d
                                                                                                                                                                                                                                  • Instruction ID: 1c65db0457a56d7080999e7fd3b6252525a805bea136b40537fbd1f3558af3b0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 92c6385937ce34e89bd0cc7f83ea8e28bc61e47f82b79eefdecfbc72e9487f3d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0AC146756087109FC700DFA8C880D1AB7EABFD9314F648E4DF5988B265D735E846CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69839D00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 69839DEB
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69839DFB
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69839E29
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 69839F25
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69839FE5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$ClearDestroyElementVariant
                                                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                                                  • API String ID: 3214203402-2766056989
                                                                                                                                                                                                                                  • Opcode ID: 91e8334e709ea13d019d0dbc065349a0b8b50049d5108f6c3e2ae22de130175d
                                                                                                                                                                                                                                  • Instruction ID: 19bd3072f9a8b340ca661741c4b4c16465f4fe466819e051251d814b88a193ac
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 91e8334e709ea13d019d0dbc065349a0b8b50049d5108f6c3e2ae22de130175d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E4D17971900259CFDF00CFE8C980A9DBBB5BF98314FA4896DE515AB344DB72AA45CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69824D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824DA9
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 6988913A
                                                                                                                                                                                                                                    • Part of subcall function 69889125: __CxxThrowException@8.LIBCMT ref: 6988914F
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 69889160
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824DCA
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824DE5
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69824E4D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
                                                                                                                                                                                                                                  • String ID: invalid string position$string too long
                                                                                                                                                                                                                                  • API String ID: 443534600-4289949731
                                                                                                                                                                                                                                  • Opcode ID: f71089ec91dea722ffac8029c28f6c2e2a9bb3f93c566c936cb66d8f5aca4577
                                                                                                                                                                                                                                  • Instruction ID: 357f64cff008f082689ee8b92170681edecdddb2411b2d7c34cf1ad0c919c7eb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f71089ec91dea722ffac8029c28f6c2e2a9bb3f93c566c936cb66d8f5aca4577
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9531B1367042149FE324CE7CE880A6AF3E5ABE0764B200E2EE552CF241D761D88087F1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698944E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Name::operator+$NameName::
                                                                                                                                                                                                                                  • String ID: throw(
                                                                                                                                                                                                                                  • API String ID: 168861036-3159766648
                                                                                                                                                                                                                                  • Opcode ID: 9f92d89e1b3cc8efa54b9aec3643bfd661394d1ed30b7bf681b5bb5241df08b1
                                                                                                                                                                                                                                  • Instruction ID: e60899ed5d95afb6ee352d166eed795db91cce90549a01ee5fbf8a015db60046
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f92d89e1b3cc8efa54b9aec3643bfd661394d1ed30b7bf681b5bb5241df08b1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6F019274A10109AFCF04DBACC855DED7BB9EB94348F40985DF506AB294DB30D9468790
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988CCF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __getptd_noexit.LIBCMT ref: 6988CCFA
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: GetLastError.KERNEL32(?,?,6988D7DD,69889DEF,00000000,?,69889BD4,69821290,3B921FC0), ref: 6988EA71
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: ___set_flsgetvalue.LIBCMT ref: 6988EA7F
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: __calloc_crt.LIBCMT ref: 6988EA93
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: DecodePointer.KERNEL32(00000000,?,?,6988D7DD,69889DEF,00000000,?,69889BD4,69821290,3B921FC0), ref: 6988EAAD
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: GetCurrentThreadId.KERNEL32 ref: 6988EAC3
                                                                                                                                                                                                                                    • Part of subcall function 6988EA6D: SetLastError.KERNEL32(00000000,?,?,6988D7DD,69889DEF,00000000,?,69889BD4,69821290,3B921FC0), ref: 6988EADB
                                                                                                                                                                                                                                  • __calloc_crt.LIBCMT ref: 6988CD1C
                                                                                                                                                                                                                                  • __get_sys_err_msg.LIBCMT ref: 6988CD3A
                                                                                                                                                                                                                                  • _strcpy_s.LIBCMT ref: 6988CD42
                                                                                                                                                                                                                                  • __invoke_watson.LIBCMT ref: 6988CD57
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 6988CD07, 6988CD2A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast__calloc_crt$CurrentDecodePointerThread___set_flsgetvalue__get_sys_err_msg__getptd_noexit__invoke_watson_strcpy_s
                                                                                                                                                                                                                                  • String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
                                                                                                                                                                                                                                  • API String ID: 3117964792-798102604
                                                                                                                                                                                                                                  • Opcode ID: b4e7a98c7dfd6d7e05adaa1dd91a12b188233e02b9748a318f2226ca251209ff
                                                                                                                                                                                                                                  • Instruction ID: ce6bc3101bd695f37ebfbc45350261b98c0b57aba8c14bd4b8c90ec750266c67
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b4e7a98c7dfd6d7e05adaa1dd91a12b188233e02b9748a318f2226ca251209ff
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ABF0247760821867DB10796D6F8195B7EAC9BA1768B005E3EF508DB106F766E80042B4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988E9B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KERNEL32.DLL,698B9880,00000008,6988EAC1,00000000,00000000,?,?,6988D7DD,69889DEF,00000000,?,69889BD4,69821290,3B921FC0), ref: 6988E9CA
                                                                                                                                                                                                                                  • __lock.LIBCMT ref: 6988E9FE
                                                                                                                                                                                                                                    • Part of subcall function 69892438: __mtinitlocknum.LIBCMT ref: 6989244E
                                                                                                                                                                                                                                    • Part of subcall function 69892438: __amsg_exit.LIBCMT ref: 6989245A
                                                                                                                                                                                                                                    • Part of subcall function 69892438: EnterCriticalSection.KERNEL32(69889BD4,69889BD4,?,6988EA03,0000000D), ref: 69892462
                                                                                                                                                                                                                                  • InterlockedIncrement.KERNEL32(FFFFFEF5), ref: 6988EA0B
                                                                                                                                                                                                                                  • __lock.LIBCMT ref: 6988EA1F
                                                                                                                                                                                                                                  • ___addlocaleref.LIBCMT ref: 6988EA3D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
                                                                                                                                                                                                                                  • String ID: KERNEL32.DLL
                                                                                                                                                                                                                                  • API String ID: 637971194-2576044830
                                                                                                                                                                                                                                  • Opcode ID: 056afc47b3626feec4244e0e51f51036b8d48c0cd93dfc823e29ca8d35b2e8d0
                                                                                                                                                                                                                                  • Instruction ID: 6868ea9c3b9dc09b8a0363b7e3ac2e2dce694bc953ab33e5989c7ee9436cda84
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 056afc47b3626feec4244e0e51f51036b8d48c0cd93dfc823e29ca8d35b2e8d0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC018B75404B00EED720EF69C604749FBE0EF61328F60DD0ED496973A0CBB4A600CB61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983E120 Relevance: 9.4, APIs: 6, Instructions: 364COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6983E29B
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6983E2B6
                                                                                                                                                                                                                                  • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6983E2D7
                                                                                                                                                                                                                                    • Part of subcall function 69845760: std::tr1::_Xweak.LIBCPMT ref: 69845769
                                                                                                                                                                                                                                  • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6983E309
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6983E523
                                                                                                                                                                                                                                  • InterlockedCompareExchange.KERNEL32(698CC6A4,45524548,4B4F4F4C), ref: 6983E544
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2722669376-0
                                                                                                                                                                                                                                  • Opcode ID: fbf6c24de36ce78648fdd2730108b1e09f1874ceba97ead2e91a21e6ca3b9933
                                                                                                                                                                                                                                  • Instruction ID: b0374b765f6ea8acd6550ddf24fc7d99ff57681fbabf53aa24de3fe307fab3a8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fbf6c24de36ce78648fdd2730108b1e09f1874ceba97ead2e91a21e6ca3b9933
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8CD1AF75A002149FDB00CFE8C894BAE77B8AF45304F94986DE809EB281E775ED44CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848A9A Relevance: 9.1, APIs: 6, Instructions: 130COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: adbdcb5dca3b56add1b5db04f86716f993ab4027eae9d6bf99326acbac0fdbf5
                                                                                                                                                                                                                                  • Instruction ID: d9b611867e58a85649d22f712b8bf8ea5b0918f45410ba721250a1edb6dc151b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: adbdcb5dca3b56add1b5db04f86716f993ab4027eae9d6bf99326acbac0fdbf5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B414874A016189FCB00CFA9C980E5EB7FABF99700F60899AE519EB355DB71E841CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848DE8 Relevance: 9.1, APIs: 6, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: 6309369288011f92b764bfb521237e0b790c05b077ea35ca3f33f83d35d6015a
                                                                                                                                                                                                                                  • Instruction ID: 86918e002c8a84c41098bc6a2c5c4fb2e11984db90538ef0d86b71213a2ca4cf
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6309369288011f92b764bfb521237e0b790c05b077ea35ca3f33f83d35d6015a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F2415E74A006189FDB00CFA8CD80F5EB7B9BF99610F6089AAE518EB355D731E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840338 Relevance: 9.1, APIs: 6, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: 6309369288011f92b764bfb521237e0b790c05b077ea35ca3f33f83d35d6015a
                                                                                                                                                                                                                                  • Instruction ID: a352507e4a949fcc0b6ffd975af0f9478f661b80b8a1835d0dd3abbef0fe790f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6309369288011f92b764bfb521237e0b790c05b077ea35ca3f33f83d35d6015a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE416A74A006089FCB00CFA8CD80B9EBBB9BF99610F20899EE518E7255CB35E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848BDD Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: 0902711525d9e2b2381ad99aed90b2aa58b122f93072f9ddd1496ec335963dd0
                                                                                                                                                                                                                                  • Instruction ID: 922469814052f6dedeb06111a020f994c2853a4565794484948f8f67d7709030
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0902711525d9e2b2381ad99aed90b2aa58b122f93072f9ddd1496ec335963dd0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E316C74E016089FCB10CFA8CC80B5EB7B9BF99610F6089AAE419EB255C771ED41CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848CE7 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: b0fa8265a5cdc7f7932725bba2be1074143002d2712edca8bee89d9a095c3cdd
                                                                                                                                                                                                                                  • Instruction ID: c1987e2d0945e9403672a88429c3b1a8c9a64d9fde216d6bde668a8095cd6001
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b0fa8265a5cdc7f7932725bba2be1074143002d2712edca8bee89d9a095c3cdd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69314D74E016189FCB00CFA8CD80B5EB7F9AF99610F608AAAE419EB255D771ED41CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848F83 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: c0a6451e6d3baa0d2741322349069cf395b3ce96cff0b93e47c2f9537f407788
                                                                                                                                                                                                                                  • Instruction ID: 3bb63c8030fd35b1aa326121ddaf4f5c5df7f09b7a6db43d49015f7e9bc529e8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0a6451e6d3baa0d2741322349069cf395b3ce96cff0b93e47c2f9537f407788
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36315C74E006089FCB00CFA8CC80B5EB7B9AF99710F60899AE518EB241CB75E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698405DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: c28ceee4f39c8d9b6373d14385f500b982e1b37ee65bbf6d311afb88d2c2a186
                                                                                                                                                                                                                                  • Instruction ID: 47dafa2ad470202e679bd7da59ed2d03dd461fbf37782013b8a68cfcb90c7070
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c28ceee4f39c8d9b6373d14385f500b982e1b37ee65bbf6d311afb88d2c2a186
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B2315974A046189FCB00CFA8CD80B5EB7B9BF99710F208A8AE418EB255DB75ED41CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698404D3 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: c0a6451e6d3baa0d2741322349069cf395b3ce96cff0b93e47c2f9537f407788
                                                                                                                                                                                                                                  • Instruction ID: c64cc3799874e2077a9ff9fe0b346cd9dd78068df786857bb102d96dee3ea1e5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0a6451e6d3baa0d2741322349069cf395b3ce96cff0b93e47c2f9537f407788
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B9315A70A046089FCB00CFA9CD80B5EB7B9BF99710F20898AE518E7255DB75ED41CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840668 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: 683ea27fc48f6e20c4b58d0b47777c7d49a73a85a359f20072429f1906e822fb
                                                                                                                                                                                                                                  • Instruction ID: c681f381218e3646b794a57bb954723ecf61d852b9026df052bf1187d579b24b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 683ea27fc48f6e20c4b58d0b47777c7d49a73a85a359f20072429f1906e822fb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 13317C70A046089FCB00CFA8CD80B5EB7B9AF99710F20899AE419EB251CB75DD41CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984C150 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6984C180
                                                                                                                                                                                                                                  • SafeArrayPutElement.OLEAUT32(00000000,69843749,?), ref: 6984C1B8
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C1C4
                                                                                                                                                                                                                                  • VariantCopy.OLEAUT32(69843749,?), ref: 6984C21B
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 6984C22F
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 6984C23E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafeVariant$Clear$CopyCreateDestroyElementVector
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3979206172-0
                                                                                                                                                                                                                                  • Opcode ID: b0c7ac063a7f9a72677779c210a98c31173e2e14ccda2a7eba0c592ae6496b1c
                                                                                                                                                                                                                                  • Instruction ID: 5ea8e6554748a662bc225f65188c7537350cf75d192d59c1ee1d27d472e220e4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b0c7ac063a7f9a72677779c210a98c31173e2e14ccda2a7eba0c592ae6496b1c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3D313A75A04249EFDB00DFA8C884B9EBBB8EF99704F108529E915D7351EB35E905CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984884F Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: b2a170ecf90d58ff1061028c7106ca21936e8631e57705ab4fd845e43c2abdb9
                                                                                                                                                                                                                                  • Instruction ID: 24b175e66cd863805b1ceeaa00ff4eec1370981faec9ffb95edcd3464fcbb9de
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b2a170ecf90d58ff1061028c7106ca21936e8631e57705ab4fd845e43c2abdb9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EA313A74E0061C9FDB10CBA8CD80B5EB7BABF99610F6089AAE419EB241C771E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848B64 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: fc40aa4cc7a21ed87a948d9e735666462bfc5b0e0560084a75f4d03ffe0d2130
                                                                                                                                                                                                                                  • Instruction ID: 0813ed227e3ed9c7d6ca719065645a082ed070c90b80423a9e9b69d160dd606f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc40aa4cc7a21ed87a948d9e735666462bfc5b0e0560084a75f4d03ffe0d2130
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DD313AB0E0161C9FCB10CBA8CC80B5EB7B9BF95610F6489AAE429EB245C775E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848D72 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: d8cddda14a3242d88d33a6c1693d22d2987079b63c379e162eb4a87f332da9a9
                                                                                                                                                                                                                                  • Instruction ID: a6db96f15ef2cdc36c9cf9bb1be4491ddf82c39a5ae31fd332af24d67406e7e5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8cddda14a3242d88d33a6c1693d22d2987079b63c379e162eb4a87f332da9a9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4313E70E0161C9FCB10CFA8CD84B9EB7B9BF95610F608AAAE419EB245D771E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848C6E Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: eaf99dd84bca5da8fac0050a8a7605dc440130694bd9704e28b27403e40faaa5
                                                                                                                                                                                                                                  • Instruction ID: 17997551c04b05191f9a2ec333dc90ed4c0a6ef8ed3e180f23041ce7f15a6b57
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eaf99dd84bca5da8fac0050a8a7605dc440130694bd9704e28b27403e40faaa5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A313A70E016189FDB10DBA8CC80B9EB7B9BF95610F6489AAE419EB245C771ED41CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848F07 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: fff1a39e3d7d09cd1a6496cb2a4caa8181498210d5e6d77cb1ac122a6fd8974e
                                                                                                                                                                                                                                  • Instruction ID: 07449af7223ba95f6d53cbf12d55711ec6f5f8da2dba55d99890369db253c0c7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fff1a39e3d7d09cd1a6496cb2a4caa8181498210d5e6d77cb1ac122a6fd8974e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E312971A006189FDB10CBA8CC80B9EB7BABF95710F6489AAE519EB241C771E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848E8E Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: cd393f3cee178d01e891546ab59018b805a301e6f89bf55da99c4ecc3275ad7f
                                                                                                                                                                                                                                  • Instruction ID: 4e03b4670eaff7f706062cd3be198d481585455767823a4fe57accd67373cb11
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd393f3cee178d01e891546ab59018b805a301e6f89bf55da99c4ecc3275ad7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7313C70E0061C9FCB10CFA8CD84B9EB7B9BF95610F608AAAE419EB245C771E941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698401BE Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: eaf99dd84bca5da8fac0050a8a7605dc440130694bd9704e28b27403e40faaa5
                                                                                                                                                                                                                                  • Instruction ID: 3613e00204ca13cadfd25a9fe010a7c36089dd1ecd044968525d01dfa55acdfc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eaf99dd84bca5da8fac0050a8a7605dc440130694bd9704e28b27403e40faaa5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE313870A046189FDB10DBA9CC80B9DB7BABF95610F20899EE418E7256CB75E981CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698400B4 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: fc40aa4cc7a21ed87a948d9e735666462bfc5b0e0560084a75f4d03ffe0d2130
                                                                                                                                                                                                                                  • Instruction ID: 7dd3fce3d2be7392b926d39de51c5b28414273fcb79ea283aed35f4ca89172d1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc40aa4cc7a21ed87a948d9e735666462bfc5b0e0560084a75f4d03ffe0d2130
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 13311870A046189FCB10DFA9CD80B9DB7B9BF99710F20898EE418E7256CB75D981CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698403DE Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: cd393f3cee178d01e891546ab59018b805a301e6f89bf55da99c4ecc3275ad7f
                                                                                                                                                                                                                                  • Instruction ID: ff8a1d635d134045de2921cd8c5aa5b73d9eff46e5b9007827971ae1cc99d986
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd393f3cee178d01e891546ab59018b805a301e6f89bf55da99c4ecc3275ad7f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 74314B70A046189FCB10CFA9CD80B9DB7B9BF95710F608A8EE418E7295CB75E981CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698402C2 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: d8cddda14a3242d88d33a6c1693d22d2987079b63c379e162eb4a87f332da9a9
                                                                                                                                                                                                                                  • Instruction ID: 850d87682dc06812b8ccddadb47567875e2c12e6e3c075d234c5d2b87c9ab46a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8cddda14a3242d88d33a6c1693d22d2987079b63c379e162eb4a87f332da9a9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F314B70A046189FCB10CFA9CD80B9DB7B9BF95710F608A8EE419E7256C775D941CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69840561 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: df61eadb7b27df16242e8f080b5bbd88854dfa1f48197b97c09273a1b92408d9
                                                                                                                                                                                                                                  • Instruction ID: 65ff5012893b21f2fa7f1408773dbed298b1b44760643db3b05e21860d1220dc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: df61eadb7b27df16242e8f080b5bbd88854dfa1f48197b97c09273a1b92408d9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 19314970A046189FCB10DFA9CD80B9EB7B9BF99710F20898EE418E7256C775D981CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983FD9F Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArrayDestroySafe
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225690600-0
                                                                                                                                                                                                                                  • Opcode ID: b2a170ecf90d58ff1061028c7106ca21936e8631e57705ab4fd845e43c2abdb9
                                                                                                                                                                                                                                  • Instruction ID: 2f52c5547082e765bb5a6823fec7181bb60e20614eef47e6b38c32b0a4ae5d63
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b2a170ecf90d58ff1061028c7106ca21936e8631e57705ab4fd845e43c2abdb9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FF314970A046189FDB10CBA9CD80B9DB7B9BF99610F60898EE418E7255C775ED41CF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6989249C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000100,?,?,?,?,?,698925B1,?,00000000,?), ref: 698924E6
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 6989251B
                                                                                                                                                                                                                                  • _memset.LIBCMT ref: 6989253B
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 69892550
                                                                                                                                                                                                                                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6989255E
                                                                                                                                                                                                                                  • __freea.LIBCMT ref: 69892568
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharMultiWide$StringType__freea_malloc_memset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 525495869-0
                                                                                                                                                                                                                                  • Opcode ID: c0c1bf3660bb311e4c40b8f6875acee5565c618e6e058ee5c46bceb5ca12f536
                                                                                                                                                                                                                                  • Instruction ID: e92b343f95031eb161395cc0d9485e77bd1b49403fb6231941431288f0c93b3e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0c1bf3660bb311e4c40b8f6875acee5565c618e6e058ee5c46bceb5ca12f536
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 26316DB161020AAFEF01CF68DC90EAF7BA9EB48354F114829F915D7254E738DD61DB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69848A39 Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 69846A08
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69846A15
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69846A41
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Destroy$Bound$Element
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 757764206-0
                                                                                                                                                                                                                                  • Opcode ID: b9af9f7a3dce387130a5717be162b6388f63aca00a4c345eb972f6d3f43b38cc
                                                                                                                                                                                                                                  • Instruction ID: 4212e91eb6d12ef563b85f695c993dc5d90cc3ffb2c7f39891e7a156bfa9c050
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b9af9f7a3dce387130a5717be162b6388f63aca00a4c345eb972f6d3f43b38cc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D311E71E0061C9FCB10CBA8CD80B9EB7B9AF95710F644AAAE419EB241C775ED80CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698487EE Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 69846A08
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69846A15
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69846A41
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE63
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE73
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE86
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AE99
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEAC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984AEBF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Destroy$Bound$Element
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 757764206-0
                                                                                                                                                                                                                                  • Opcode ID: b386df93954cbdcc1801660d8993b0802be50f8c4841de606ce1302c63eed7b5
                                                                                                                                                                                                                                  • Instruction ID: 5b87064eb93186f7eeb99beb401f3c70aa0de8acfda1c619c5284ebc14722604
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b386df93954cbdcc1801660d8993b0802be50f8c4841de606ce1302c63eed7b5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36313C70E0061C9FCB10CBA8CD80B9EB7BAAF95710F60899AE419EB245C775ED80CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6983FD3E Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 69846A08
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 69846A15
                                                                                                                                                                                                                                    • Part of subcall function 698469C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 69846A41
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423B3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423C3
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423D6
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423E9
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 698423FC
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984240F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Destroy$Bound$Element
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 757764206-0
                                                                                                                                                                                                                                  • Opcode ID: b386df93954cbdcc1801660d8993b0802be50f8c4841de606ce1302c63eed7b5
                                                                                                                                                                                                                                  • Instruction ID: 87dfbd50cfb307ef333522df772d52a077d32e1a67a5999a76d342e9a98b02b8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b386df93954cbdcc1801660d8993b0802be50f8c4841de606ce1302c63eed7b5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34314970E046189BCB10CBA9CD80B9DB7BAAF95710F60898EE408E7255CB75DD81CF50
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698806A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824760: __CxxThrowException@8.LIBCMT ref: 698247F9
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69880907
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69880936
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69880959
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69880A25
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • PSSR_MEM: message recovery disabled, xrefs: 698809E3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove$Exception@8Throw
                                                                                                                                                                                                                                  • String ID: PSSR_MEM: message recovery disabled
                                                                                                                                                                                                                                  • API String ID: 2655171816-3051149714
                                                                                                                                                                                                                                  • Opcode ID: d05a3b70e3e0b69d17ebbd4779e40c730a827dc6cb97738fd698d6953c7d1ca8
                                                                                                                                                                                                                                  • Instruction ID: b1a9405d920fb326ab8839422f344d94b23e09d82122027a34a0b1d84a28236f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d05a3b70e3e0b69d17ebbd4779e40c730a827dc6cb97738fd698d6953c7d1ca8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 64C166B56093419FD714CF28C980BAABBE5BFD9304F048A5CE589C7385DB34E945CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987AE90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _strncmptype_info::operator!=
                                                                                                                                                                                                                                  • String ID: ThisPointer:$ValueNames
                                                                                                                                                                                                                                  • API String ID: 1333309372-2375088429
                                                                                                                                                                                                                                  • Opcode ID: e50ae44b13155fd2a2e44762384a58fb7eedfe616ea85cef369d06691e5d4ecd
                                                                                                                                                                                                                                  • Instruction ID: 996d53e135f529d269d4f4a952e55ed05acc2f215f957e868a482905ab8c7f38
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e50ae44b13155fd2a2e44762384a58fb7eedfe616ea85cef369d06691e5d4ecd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7451F6752087405FC324CF68C991A2BB7EBAFA6358F048E1DF4968F351D722E8088751
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6985A360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _strncmptype_info::operator!=
                                                                                                                                                                                                                                  • String ID: ThisPointer:$ValueNames
                                                                                                                                                                                                                                  • API String ID: 1333309372-2375088429
                                                                                                                                                                                                                                  • Opcode ID: 15bdab8cf4ae30cce75885b196bbef5c562d14dffbea6b5bef115fbdb1cb9cb9
                                                                                                                                                                                                                                  • Instruction ID: 0e284bfd5e06014e7a8e190dd709385b480223454d560c3dd30bcf8920cf7649
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15bdab8cf4ae30cce75885b196bbef5c562d14dffbea6b5bef115fbdb1cb9cb9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3B51F7752087445BC310CFA8D9D4A27B7EAAF95368F048E5DE4978B342D722E81CC7A1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6987B9B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _strncmptype_info::operator!=
                                                                                                                                                                                                                                  • String ID: ThisPointer:$ValueNames
                                                                                                                                                                                                                                  • API String ID: 1333309372-2375088429
                                                                                                                                                                                                                                  • Opcode ID: b35ec30ff3fb48594f7343aeeb2a8dc4794cc507f17cffffa1e78bef17c78dda
                                                                                                                                                                                                                                  • Instruction ID: f598a707f0d9d2f546f5f51ebf434ee602aae1811ca037e29a15d6c922b05e89
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b35ec30ff3fb48594f7343aeeb2a8dc4794cc507f17cffffa1e78bef17c78dda
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7C51B4752083445BC324DF68C991E2BB7EBAFA5358F448E6CE4A68F351D722E809C791
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69861B70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69861C1A
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69861CDE
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69861D3E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • TF_SignerBase: this algorithm does not support messsage recovery or the key is too short, xrefs: 69861C67
                                                                                                                                                                                                                                  • TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 69861CF0
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                                                                                  • String ID: TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support messsage recovery or the key is too short
                                                                                                                                                                                                                                  • API String ID: 3476068407-3371871069
                                                                                                                                                                                                                                  • Opcode ID: 70dfde39f46a0875109e4b1eb0187809a8c7250992f8e91f200c73bc1ce154b2
                                                                                                                                                                                                                                  • Instruction ID: 69abcc7c213dc24eccf385e18cadfa03db9a0883571a91535a40f64b3b844df6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70dfde39f46a0875109e4b1eb0187809a8c7250992f8e91f200c73bc1ce154b2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F5136752087409FD364DF68C880F9EF7E9BFC8314F108A1EE58997391DB74A9458BA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69824010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 6988913A
                                                                                                                                                                                                                                    • Part of subcall function 69889125: __CxxThrowException@8.LIBCMT ref: 6988914F
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 69889160
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824067
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 698240C8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
                                                                                                                                                                                                                                  • String ID: invalid string position$string too long
                                                                                                                                                                                                                                  • API String ID: 1615890066-4289949731
                                                                                                                                                                                                                                  • Opcode ID: 1fe29aa14287444d6dc25bc438999f22b5001c2ceb8ddfa2c6a9d13a070db2ef
                                                                                                                                                                                                                                  • Instruction ID: 506fbade0e2bbfa30338d6dbeff2e0a7f05e79977d1175b3f127c40e99ef62e3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fe29aa14287444d6dc25bc438999f22b5001c2ceb8ddfa2c6a9d13a070db2ef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 453195327042149BD321CE6CE880A6EF7A9EBE1765F204E2FE551CB281D76298C187F1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6988C23B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___BuildCatchObject.LIBCMT ref: 6988C24E
                                                                                                                                                                                                                                    • Part of subcall function 6988C1A9: ___BuildCatchObjectHelper.LIBCMT ref: 6988C1DF
                                                                                                                                                                                                                                  • _UnwindNestedFrames.LIBCMT ref: 6988C265
                                                                                                                                                                                                                                  • ___FrameUnwindToState.LIBCMT ref: 6988C273
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                                                                                                  • API String ID: 2163707966-3733052814
                                                                                                                                                                                                                                  • Opcode ID: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
                                                                                                                                                                                                                                  • Instruction ID: b329224c2ae6614734c5054307257f5c99da61ca36841282976e054eb312317e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 74012435000109BBDF129F94CE45EAA7F6AFF08354F008918FD18261A0D732D8A2DBB0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69862300 Relevance: 7.8, APIs: 5, Instructions: 257COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4104443479-0
                                                                                                                                                                                                                                  • Opcode ID: 3c03a628e5c5d8a99dc0a7cf702f52f9a1289ae13de3993217eaf2f93bd33ecb
                                                                                                                                                                                                                                  • Instruction ID: 654ad28aab9254be8c4fe9c3882f965985a35f3c821124dbe8ccaf08938c9952
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3c03a628e5c5d8a99dc0a7cf702f52f9a1289ae13de3993217eaf2f93bd33ecb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 28919C756087018FD714DF68C980A2BB7E9FB98714F104E6DE495CB354E738E906CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69836D40 Relevance: 7.6, APIs: 5, Instructions: 101COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • _rand.LIBCMT ref: 69836DEA
                                                                                                                                                                                                                                    • Part of subcall function 69889E0C: __getptd.LIBCMT ref: 69889E0C
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69836E17
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69836E2C
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69836E3B
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69836E50
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C04
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C1E
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: __CxxThrowException@8.LIBCMT ref: 69889C2F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8Throw$__getptd_malloc_rand
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2791304714-0
                                                                                                                                                                                                                                  • Opcode ID: ac666192fe56bb6f4969ed672c8dd30769a4821b31f6d9fc9f07c0189880c91a
                                                                                                                                                                                                                                  • Instruction ID: 48163048b8c9313c127d5650a5c6be38c76f1f1b1ed7628dd2b2dab931dc558c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac666192fe56bb6f4969ed672c8dd30769a4821b31f6d9fc9f07c0189880c91a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A63156B59007049FCB50CF68C880A8AFBF4FB18314F54C96ED85A97B41D775E608CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69825AAC Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69825ACB
                                                                                                                                                                                                                                    • Part of subcall function 69889533: std::exception::_Copy_str.LIBCMT ref: 6988954E
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69825ABC
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69825AE0
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69825B18
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69825B2D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw$std::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 921928366-0
                                                                                                                                                                                                                                  • Opcode ID: c46080bb9816fee3eab0cdab5206e93b2b163f247105e1817370c6902ac9a177
                                                                                                                                                                                                                                  • Instruction ID: d054d309e8ab85cee6bbcbd6c5a7ca1f99020734b6ab9439a2d1cfb43508339a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c46080bb9816fee3eab0cdab5206e93b2b163f247105e1817370c6902ac9a177
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6A014CB6810208ABDB04DFA8D9459DE77BCAF25344F40D96DE809A7244EB35E608CBB1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6986E6E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memcpy_s
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2001391462-3916222277
                                                                                                                                                                                                                                  • Opcode ID: 8df3c7cb254e94a13b6acb9c11cc6af8726ed36e275fe2d6a9cc89176ee8abf0
                                                                                                                                                                                                                                  • Instruction ID: 17490bca9637f1cba1a8245e56395a64269302e4eac503a8a97d7433652a6812
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8df3c7cb254e94a13b6acb9c11cc6af8726ed36e275fe2d6a9cc89176ee8abf0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8C1AC756083068FE704CF28C984A6AB7E2FFD9314F044E2DE596CB265E731E959CB42
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69888B60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 252COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memcpy_s_memmove_memset
                                                                                                                                                                                                                                  • String ID: EncodingParameters
                                                                                                                                                                                                                                  • API String ID: 4034675494-55378216
                                                                                                                                                                                                                                  • Opcode ID: 32445173d646e8e6dcdfadf7d5ac2de39178ad1057a55c276a4430c642b94b5c
                                                                                                                                                                                                                                  • Instruction ID: fdfc9514f146d3716d1e218368cd3be7ae81ad631f29bc46e3aa4909ca067ce4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 32445173d646e8e6dcdfadf7d5ac2de39178ad1057a55c276a4430c642b94b5c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C39176746083819FD700CF28C980B5BBBE5BFDA748F14491DF8A987391D675E944CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __cftoe.LIBCMT ref: 698388ED
                                                                                                                                                                                                                                    • Part of subcall function 6988A116: __mbstowcs_s_l.LIBCMT ref: 6988A12C
                                                                                                                                                                                                                                  • __cftoe.LIBCMT ref: 69838911
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __cftoe$__mbstowcs_s_l
                                                                                                                                                                                                                                  • String ID: zX$P
                                                                                                                                                                                                                                  • API String ID: 1494777130-2079734279
                                                                                                                                                                                                                                  • Opcode ID: 9b62730bdf1a1e5aaa11c6ad110193cb33efcb1a55c2408e63762c77752660c8
                                                                                                                                                                                                                                  • Instruction ID: 16a3f666b10b272cf8865f314d29c187fd0effeed501fb02fe8aa7d5b0d65210
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9b62730bdf1a1e5aaa11c6ad110193cb33efcb1a55c2408e63762c77752660c8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A19100B51087819FC376CF19C980BABBBE8BB84714F508E1DE19D8B280DB715645CF92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698589D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69858ABB
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69858B82
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • : invalid ciphertext, xrefs: 69858B48
                                                                                                                                                                                                                                  • PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 69858A8E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw
                                                                                                                                                                                                                                  • String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long
                                                                                                                                                                                                                                  • API String ID: 2005118841-483996327
                                                                                                                                                                                                                                  • Opcode ID: 46dc6cf82aa3221c93788fb01e6389d633c4587b0666c02cb12bdec8013b07b4
                                                                                                                                                                                                                                  • Instruction ID: dbc2918ba606d1cc44ef17bafb6d84eade6bcac6ce1249b43dfd2dd09c92f97a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 46dc6cf82aa3221c93788fb01e6389d633c4587b0666c02cb12bdec8013b07b4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AB513AB51147409FD324CF68C990EABB7F8ABD8704F008E1DE59A97741DB35E909CB62
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69856B00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69856BA6
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 69824067
                                                                                                                                                                                                                                    • Part of subcall function 69824010: _memmove.LIBCMT ref: 698240C8
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69856C56
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 69856BE3
                                                                                                                                                                                                                                  • NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes, xrefs: 69856B33
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
                                                                                                                                                                                                                                  • String ID: NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes$RandomNumberGenerator: IncorporateEntropy not implemented
                                                                                                                                                                                                                                  • API String ID: 1902190269-184618050
                                                                                                                                                                                                                                  • Opcode ID: 6b1ce6957d7a9ad2e4c13283cb8ef94e935a60fe6478e181cfaddd9d6b83e256
                                                                                                                                                                                                                                  • Instruction ID: a9452a8b816e76c7d8556b1b1f2dcc8c7c20e86515a1528663a72c1fa862b49c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6b1ce6957d7a9ad2e4c13283cb8ef94e935a60fe6478e181cfaddd9d6b83e256
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A513775108380AFC300CF69C980A5BFBE8BB99754F805E1EF59597390DBB9D908CB96
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69824E80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824EFC
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824F16
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69824F6C
                                                                                                                                                                                                                                    • Part of subcall function 69824D90: std::_Xinvalid_argument.LIBCPMT ref: 69824DA9
                                                                                                                                                                                                                                    • Part of subcall function 69824D90: std::_Xinvalid_argument.LIBCPMT ref: 69824DCA
                                                                                                                                                                                                                                    • Part of subcall function 69824D90: std::_Xinvalid_argument.LIBCPMT ref: 69824DE5
                                                                                                                                                                                                                                    • Part of subcall function 69824D90: _memmove.LIBCMT ref: 69824E4D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$_memmove
                                                                                                                                                                                                                                  • String ID: string too long
                                                                                                                                                                                                                                  • API String ID: 2168136238-2556327735
                                                                                                                                                                                                                                  • Opcode ID: c7b8ae0d2a13dced8d6a951062bba9bf003be5e7ab2eafe751053b4a29dc8d61
                                                                                                                                                                                                                                  • Instruction ID: c83c4e59d8b0083dfe78434155cdf85461cefd841425b2705b601a13076b1a04
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7b8ae0d2a13dced8d6a951062bba9bf003be5e7ab2eafe751053b4a29dc8d61
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E31D5367106108BE324DE7CE48096AF7EAEFE16607608E2EE555CB681C77198C487F1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69822090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6982211F
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 69824067
                                                                                                                                                                                                                                    • Part of subcall function 69824010: _memmove.LIBCMT ref: 698240C8
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 698221BF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 6982215D
                                                                                                                                                                                                                                  • PK_MessageAccumulator: DigestSize() should not be called, xrefs: 698220BD
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
                                                                                                                                                                                                                                  • String ID: PK_MessageAccumulator: DigestSize() should not be called$PK_MessageAccumulator: TruncatedFinal() should not be called
                                                                                                                                                                                                                                  • API String ID: 1902190269-1268710280
                                                                                                                                                                                                                                  • Opcode ID: 87d23407d39286b0b8c57c918f4f0011677ff7dd07ecdc84eb9044b88f7b895d
                                                                                                                                                                                                                                  • Instruction ID: 944caa4bccb8521aee3d62575aa19ac9091338f9f3983f1667d4c70ed99f6467
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87d23407d39286b0b8c57c918f4f0011677ff7dd07ecdc84eb9044b88f7b895d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D411C74C0428CEEDB00DFE9D894BEDFBB8AB19314F508A5DE421A7791DB745648CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69821D30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69821DC9
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 69824067
                                                                                                                                                                                                                                    • Part of subcall function 69824010: _memmove.LIBCMT ref: 698240C8
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69821E74
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • BufferedTransformation: this object is not attachable, xrefs: 69821D67
                                                                                                                                                                                                                                  • CryptoMaterial: this object contains invalid values, xrefs: 69821E16
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
                                                                                                                                                                                                                                  • String ID: BufferedTransformation: this object is not attachable$CryptoMaterial: this object contains invalid values
                                                                                                                                                                                                                                  • API String ID: 1902190269-3853263434
                                                                                                                                                                                                                                  • Opcode ID: 6e3300d1c21b1da8f478a987980c3eb115cf804b5450816446be3229efc589c5
                                                                                                                                                                                                                                  • Instruction ID: ea267bd18b34bb80b2b5b64fa03940c6d1009e1fc7c7172bf9d074a0a2b7468d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e3300d1c21b1da8f478a987980c3eb115cf804b5450816446be3229efc589c5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 84413C74C04288EECB10CFE9D880BDDFBB8AB19314F50865EE425A7791DB755608CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69888F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(3B921FC0,3B921FC0,?,00000000), ref: 69888F7F
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(0000000A,?,00000000), ref: 69888F8F
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69889014
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Timer: QueryPerformanceCounter failed with error , xrefs: 69888FA5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CounterErrorExceptionException@8LastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: Timer: QueryPerformanceCounter failed with error
                                                                                                                                                                                                                                  • API String ID: 1823523280-4075696077
                                                                                                                                                                                                                                  • Opcode ID: f1ca7bbe55f10107e0415aaee88baed2f14232ca5e59a7c286d1fcb86168e9ac
                                                                                                                                                                                                                                  • Instruction ID: 94f0eb9d801ba3e675995d90ea028ac93f9f27ddb8701093772a75b0c5baa59c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1ca7bbe55f10107e0415aaee88baed2f14232ca5e59a7c286d1fcb86168e9ac
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F3212FB5508380DFD310CF28C885B9FB7E8FB89618F408E1DF5A997281DB7595088BA3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69888E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • QueryPerformanceFrequency.KERNEL32(3B921FC0,3B921FC0), ref: 69888E7F
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(0000000A), ref: 69888E8F
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69888F14
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Timer: QueryPerformanceFrequency failed with error , xrefs: 69888EA5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorExceptionException@8FrequencyLastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: Timer: QueryPerformanceFrequency failed with error
                                                                                                                                                                                                                                  • API String ID: 2175244869-348333943
                                                                                                                                                                                                                                  • Opcode ID: 39f0b6fc157ded65d0bb725233e570dbfc0cdb22253bf3bca01a6df097312392
                                                                                                                                                                                                                                  • Instruction ID: f7b8b6fc1b8b5aa15a7a5586ab1be82209e53458463e6ae627a3b36f73ccc86b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 39f0b6fc157ded65d0bb725233e570dbfc0cdb22253bf3bca01a6df097312392
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46212CB55083809FD310CF28C985B9FB7E8FB89714F408E1DF5A997281DB7595088BA3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69856480 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69856518
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69856558
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 69856527
                                                                                                                                                                                                                                  • Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 698564E7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                                                                                  • String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
                                                                                                                                                                                                                                  • API String ID: 3476068407-3345525433
                                                                                                                                                                                                                                  • Opcode ID: 30981e384fb689550d1fb663cbacb4ce1c2cb9a0870da51fc123c7a45aa61cfa
                                                                                                                                                                                                                                  • Instruction ID: c11aa61480cdbdc2d153b425e7da4555a013f68e146cdc10aa3fca6f436450c1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30981e384fb689550d1fb663cbacb4ce1c2cb9a0870da51fc123c7a45aa61cfa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1521D8751187809FC724CF78C544F9EB3E8BB55658F808E1DE58593284EB359409CB63
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6985C120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 6985C14E
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: gfff$gfff$vector<T> too long
                                                                                                                                                                                                                                  • API String ID: 1823113695-3369487235
                                                                                                                                                                                                                                  • Opcode ID: 5d93c12e978faf2cc6ff543330516c5823d69128df62db3a65cad08dd8509188
                                                                                                                                                                                                                                  • Instruction ID: 26bae65c9f5a8fbf39db9f959dcadadaaab84dd2255b66184fd0788a89fbf421
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d93c12e978faf2cc6ff543330516c5823d69128df62db3a65cad08dd8509188
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE01D173F040291F8391993FFE4444AEA87AAD4394319CE3EEA09DF349E531D85657C2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698625D0 Relevance: 6.2, APIs: 4, Instructions: 206COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove$Exception@8Throw
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2655171816-0
                                                                                                                                                                                                                                  • Opcode ID: fed1b3403008fb780bcd730e5a4874ebfe97b69a70d0d8e5dc3c22f5562e5b02
                                                                                                                                                                                                                                  • Instruction ID: 3db708195729af58543f4e4677a22223ee0a953400e8e3b45dc8447eb2b32d7e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fed1b3403008fb780bcd730e5a4874ebfe97b69a70d0d8e5dc3c22f5562e5b02
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2051AE753087068FDB04DF68D980A2EB7E9BFD8614F104D6DE595C7350EB38E9068B92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69845DB0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69845E87
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69845E9C
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69845EAB
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69845EC0
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C04
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C1E
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: __CxxThrowException@8.LIBCMT ref: 69889C2F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8Throw$_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2621100827-0
                                                                                                                                                                                                                                  • Opcode ID: 44441adba460f3bcfc525fd5542377ce7646f87e2497d00d72693767723b3e9e
                                                                                                                                                                                                                                  • Instruction ID: 784f6da16a51ae18d5f82288b8ad57e01da829a732a0c7b07607ca74085708fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 44441adba460f3bcfc525fd5542377ce7646f87e2497d00d72693767723b3e9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 864139B19007489FC720CF68C980A9AFBF4FF19304F44896ED85A97B41E775E604CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69882B80 Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69856480: __CxxThrowException@8.LIBCMT ref: 69856518
                                                                                                                                                                                                                                    • Part of subcall function 69856480: __CxxThrowException@8.LIBCMT ref: 69856558
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69882C9A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69882CB1
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69882CC3
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69882CDA
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C04
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: std::exception::exception.LIBCMT ref: 69889C1E
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: __CxxThrowException@8.LIBCMT ref: 69889C2F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw$std::exception::exception$_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3942750879-0
                                                                                                                                                                                                                                  • Opcode ID: fd32feefa9c58a9fdd971476639297ba14e4d8d534a857bec658349f2209b4ec
                                                                                                                                                                                                                                  • Instruction ID: 4dafd4771e10313d93f3154c7b96615b77241ff320d457fb4fb782c915699e7c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fd32feefa9c58a9fdd971476639297ba14e4d8d534a857bec658349f2209b4ec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C34159B15187419FC314CF68C980A4AFBF4FFA9714F508E2EF19A87680D775A508CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6984C410 Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6984C478
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6984C488
                                                                                                                                                                                                                                  • SafeArrayGetElement.OLEAUT32(?,00000001,?), ref: 6984C4B4
                                                                                                                                                                                                                                  • SafeArrayDestroy.OLEAUT32(?), ref: 6984C512
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$DestroyElement
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3987547017-0
                                                                                                                                                                                                                                  • Opcode ID: 99f86cc382c5b4dede429d74b2decd473951c0db0abfb2159e7dbfedf9fc21e6
                                                                                                                                                                                                                                  • Instruction ID: 9717bc9fd9dc2b2a14f5d907435bc5789b3db91608c76986b3981797d8d0d925
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 99f86cc382c5b4dede429d74b2decd473951c0db0abfb2159e7dbfedf9fc21e6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59410B75A00149EFDF00DFA8C9849EEB7B8FF59750F10896DE919E7241D730AA45CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698988C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 698988FD
                                                                                                                                                                                                                                  • __isleadbyte_l.LIBCMT ref: 69898930
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 69898961
                                                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 698989CF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3058430110-0
                                                                                                                                                                                                                                  • Opcode ID: 93bfecc61e04ced79bd305ff6d392b0435194e922b8e57ad94fe0d330027dbb7
                                                                                                                                                                                                                                  • Instruction ID: 238a6c61bf79f354c4a242faf3f61403e0e26e8e0ce2d60003584a5e067782c0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 93bfecc61e04ced79bd305ff6d392b0435194e922b8e57ad94fe0d330027dbb7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC31B231A24287EFDB00DFACC8809BE7BB5BF01310F11896DE665AB191D731D940DBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69825A30 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69825ACB
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69825AE0
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69825B18
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69825B2D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throwstd::exception::exception$_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3153320871-0
                                                                                                                                                                                                                                  • Opcode ID: c049cceed99f14ff70429af9204a20ae08e4d4364d5f17f32f93316ce3116f0a
                                                                                                                                                                                                                                  • Instruction ID: 3b7bd425137de343da7c2b74c46e6a84d05ce0a6635a3061f8e76d9c6b83b7a0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c049cceed99f14ff70429af9204a20ae08e4d4364d5f17f32f93316ce3116f0a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C3184B5900708ABCB04DF58D941A9AF7F8FF59754F40CA6EE81997740EB34AA04CBE1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69838470 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69889BB5: _malloc.LIBCMT ref: 69889BCF
                                                                                                                                                                                                                                  • InitializeCriticalSection.KERNEL32(00000000,00000000,69835D89,00000000,00000004,00000000,?,00000000,00000000), ref: 698384EA
                                                                                                                                                                                                                                  • InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000), ref: 698384F0
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 6983853C
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69838551
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalInitializeSection$Exception@8Throw_mallocstd::exception::exception
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3005353045-0
                                                                                                                                                                                                                                  • Opcode ID: 125dba89393954811d3bab3d58c831cecf0448fc3c38dc724615979d5e95534c
                                                                                                                                                                                                                                  • Instruction ID: ed443fd62ddb60f4afc3a48e518305e4e413d6b4dbec7d74aaa4972ef4837fb1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 125dba89393954811d3bab3d58c831cecf0448fc3c38dc724615979d5e95534c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 08317C75A01704AFCB00CF68C980A9AFBF8FF19210F408A6EE80687B40D770F604CB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69892645 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 69892653
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __FF_MSGBANNER.LIBCMT ref: 69889D7F
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __NMSG_WRITE.LIBCMT ref: 69889D86
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,69889BD4,69821290,3B921FC0), ref: 69889DAB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateHeap_malloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 501242067-0
                                                                                                                                                                                                                                  • Opcode ID: 3135f83d335d63e619bc1beb07a126b2b3391c3a703e7ebcf8a63d651d025390
                                                                                                                                                                                                                                  • Instruction ID: dc6574ef726c34042c73119755d5ffcf0d79cb962355b3cbdae332f660b79878
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3135f83d335d63e619bc1beb07a126b2b3391c3a703e7ebcf8a63d651d025390
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D111E736455214ABCF126F7CAD04A5D37A8AB923B0F104D2EF945D7940DF38C842C7E4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69845A70 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantInit.OLEAUT32(?), ref: 69845AB9
                                                                                                                                                                                                                                  • VariantCopy.OLEAUT32(?,698B9C90), ref: 69845AC1
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 69845AE2
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69845AEF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ClearCopyException@8InitThrow
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3826472263-0
                                                                                                                                                                                                                                  • Opcode ID: bba41beb376d5fdb4003203976a0e55d665f3d009d8091d7f15806a3a2be1802
                                                                                                                                                                                                                                  • Instruction ID: cf17cb38cabe455b9b09f8a2ea01b654006a4b00e13f45d45d7fc3f6d0d17747
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bba41beb376d5fdb4003203976a0e55d665f3d009d8091d7f15806a3a2be1802
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE11907290466CABCB00DFACC8C499EBB78FB56A64F51456EE824A3300D7786E04C7E1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69858D80 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 69858D8A
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __FF_MSGBANNER.LIBCMT ref: 69889D7F
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: __NMSG_WRITE.LIBCMT ref: 69889D86
                                                                                                                                                                                                                                    • Part of subcall function 69889D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,69889BD4,69821290,3B921FC0), ref: 69889DAB
                                                                                                                                                                                                                                    • Part of subcall function 698891F6: std::_Lockit::_Lockit.LIBCPMT ref: 69889202
                                                                                                                                                                                                                                  • _malloc.LIBCMT ref: 69858DAF
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 69858DD4
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69858DEB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _malloc$AllocateException@8HeapLockitLockit::_Throwstd::_std::exception::exception
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3043633502-0
                                                                                                                                                                                                                                  • Opcode ID: 7e1cc933390fd4baa11d7885ceb4245d6b6f57d9b8495a0b698463afc1337e4b
                                                                                                                                                                                                                                  • Instruction ID: 531d9d5ff5b392241a256c0e67bb0ad7c73a316da69c273ff07bd0bfe6f5875d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e1cc933390fd4baa11d7885ceb4245d6b6f57d9b8495a0b698463afc1337e4b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61F0247A404211ABD201EB6D9E51B9F36E8AFA1624F809C1DF85593240EB26E21CC2F3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69890A60 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3016257755-0
                                                                                                                                                                                                                                  • Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                                                                                                                                                                                  • Instruction ID: d31cc1552806d600d92dd7e71bc5dd0cdbc576d9949de9b756c5fec7a8edab1d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 22114E3605014EBBCF129E88DC11CEE3F62BB59354B498919FE2859030C336C6B1AB81
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69888970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _memmove_memset
                                                                                                                                                                                                                                  • String ID: EncodingParameters
                                                                                                                                                                                                                                  • API String ID: 3555123492-55378216
                                                                                                                                                                                                                                  • Opcode ID: a5f3ffa9a14afe4def970ea74b177a9e0d236958425fd517efd2478140515b2f
                                                                                                                                                                                                                                  • Instruction ID: 473fc42c2e56ebac3b91e4d75a32e8731594904ae07204d653180acfffee463c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a5f3ffa9a14afe4def970ea74b177a9e0d236958425fd517efd2478140515b2f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D66102B42083419FC304CF69C880A2AFBE9BFC9754F148A1DF59987391D774E945CBA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69824100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824175
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 698241C6
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$_memmove
                                                                                                                                                                                                                                  • String ID: string too long
                                                                                                                                                                                                                                  • API String ID: 2168136238-2556327735
                                                                                                                                                                                                                                  • Opcode ID: cadb1b8ebbcf7cca717cb7ac297693032114b253ede66500aa4823cd67820215
                                                                                                                                                                                                                                  • Instruction ID: 3aa96127d7b20fb3b51af650c6aa9fa3e73264b9d146b4f4a30e8f86f0ec2dbe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cadb1b8ebbcf7cca717cb7ac297693032114b253ede66500aa4823cd67820215
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F31C1367186145BD321CEACEC80A6AF7E9EBF5664B204E2FE591C7680C76198C087F1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6985C350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6985C39B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Exception@8Throw
                                                                                                                                                                                                                                  • String ID: gfff$gfff
                                                                                                                                                                                                                                  • API String ID: 2005118841-3084402119
                                                                                                                                                                                                                                  • Opcode ID: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
                                                                                                                                                                                                                                  • Instruction ID: 82e08b34309b2a4d596d40b28ac5275e01ef0422ca9c9bab0dc1f226bc0b6b05
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7C31507590020DAFDB54CF98D980EFEB7B9EB94318F44851CE9169B284D730BA19CBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698218C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 6982194F
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  • std::exception::exception.LIBCMT ref: 6982198E
                                                                                                                                                                                                                                    • Part of subcall function 698895C1: std::exception::operator=.LIBCMT ref: 698895DA
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 69824067
                                                                                                                                                                                                                                    • Part of subcall function 69824010: _memmove.LIBCMT ref: 698240C8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Clone() is not implemented yet., xrefs: 698218ED
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
                                                                                                                                                                                                                                  • String ID: Clone() is not implemented yet.
                                                                                                                                                                                                                                  • API String ID: 2192554526-226299721
                                                                                                                                                                                                                                  • Opcode ID: 450340301f7d1de98f08d751975d2e6f42a8135704f620982076e0824e255439
                                                                                                                                                                                                                                  • Instruction ID: b39acb4eab9fa89dac55e0174a8ab80542cad0540bfa699a2d66b81c919b0821
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 450340301f7d1de98f08d751975d2e6f42a8135704f620982076e0824e255439
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9A316171804248EFCB14CFA8D880BEEFBB8FB15314F508A2EE421A7781DB755504CBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69845810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 6984584D
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(00000000), ref: 69845899
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$ClearException@8ThrowVariantXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: vector<T> too long
                                                                                                                                                                                                                                  • API String ID: 2677079660-3788999226
                                                                                                                                                                                                                                  • Opcode ID: 830c0540bbcccae2adea8566592cb4cfb39f23b0b2d4272a77f4a0044c61e0fe
                                                                                                                                                                                                                                  • Instruction ID: 5fc9f52aaab2374b5da43dd808f92d6bf9f4a84e792fa7cd55fa7b7677f9203b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 830c0540bbcccae2adea8566592cb4cfb39f23b0b2d4272a77f4a0044c61e0fe
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E3216076A006099FD710CF6CD980A6FB7F9FF84764F244A2EE455E7740DB34A9408B91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 698246B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 698246C4
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 6982470B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
                                                                                                                                                                                                                                  • String ID: string too long
                                                                                                                                                                                                                                  • API String ID: 1785806476-2556327735
                                                                                                                                                                                                                                  • Opcode ID: 505b3ff0d93888a797360136d07c1968ebd0540a1ca6d44552c375054b934250
                                                                                                                                                                                                                                  • Instruction ID: 923a76d3a1cd9b66c69c19007670f945cf18851b733067f1e94c69c38344bb1c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 505b3ff0d93888a797360136d07c1968ebd0540a1ca6d44552c375054b934250
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F11B9765143145FE720DD7CA8C0A6AB7A9AFA2214F204F2ED5A783582D761A4C887B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69854D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69854E00
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • OutputBuffer, xrefs: 69854D77
                                                                                                                                                                                                                                  • ArraySink: missing OutputBuffer argument, xrefs: 69854D91
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
                                                                                                                                                                                                                                  • API String ID: 3718517217-3781944848
                                                                                                                                                                                                                                  • Opcode ID: f2102b3aef3546b13937bc9c44ddc76f6c26f283998ab0e2c2157be33022f4b0
                                                                                                                                                                                                                                  • Instruction ID: 5e055da021b0257992ae52f92860d1d23ab4845e63291032c29d4a573296aeda
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f2102b3aef3546b13937bc9c44ddc76f6c26f283998ab0e2c2157be33022f4b0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C531F5B55087809FC310CF68C490A5BBBE4BBD9714F408E1EF5A697391DB75D908CB92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69830150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 69824010: std::_Xinvalid_argument.LIBCPMT ref: 6982402A
                                                                                                                                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 69830201
                                                                                                                                                                                                                                    • Part of subcall function 6988AC75: RaiseException.KERNEL32(?,?,69889C34,3B921FC0,?,?,?,?,69889C34,3B921FC0,698B9C90,698CB974,3B921FC0), ref: 6988ACB7
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • StringSink: OutputStringPointer not specified, xrefs: 6983019B
                                                                                                                                                                                                                                  • OutputStringPointer, xrefs: 6983018C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
                                                                                                                                                                                                                                  • String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
                                                                                                                                                                                                                                  • API String ID: 3718517217-1331214609
                                                                                                                                                                                                                                  • Opcode ID: 954db2c9034b1c551fe475ada99f3590fe6e737f238bc793d42c18986d81b063
                                                                                                                                                                                                                                  • Instruction ID: c028563ccd5dd1dbf46841b3cc6a86d8db538698792405dd4d8bc5b55ac71b98
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 954db2c9034b1c551fe475ada99f3590fe6e737f238bc793d42c18986d81b063
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F213D75D04288AFCB04CFE8D990B9DFBB4AB59314F508A5EE825A7381DB355508CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69824620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69824636
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 6988913A
                                                                                                                                                                                                                                    • Part of subcall function 69889125: __CxxThrowException@8.LIBCMT ref: 6988914F
                                                                                                                                                                                                                                    • Part of subcall function 69889125: std::exception::exception.LIBCMT ref: 69889160
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 6982466F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • invalid string position, xrefs: 69824631
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
                                                                                                                                                                                                                                  • String ID: invalid string position
                                                                                                                                                                                                                                  • API String ID: 1785806476-1799206989
                                                                                                                                                                                                                                  • Opcode ID: a54c01adfc0af2ac4270b6f466d0c5ccd59413b9a86a7bf0d5b738523fc1c933
                                                                                                                                                                                                                                  • Instruction ID: 8ad2928faba01652a3f58247e04799583f0746daf0d4f8f9bf90bab09a3a8334
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a54c01adfc0af2ac4270b6f466d0c5ccd59413b9a86a7bf0d5b738523fc1c933
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C01D6313042409BE320CEBCED80A1AB7AAEBD1750B248E3DD195CB701D6B1EC8183F1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 6985ACA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • type_info::operator!=.LIBCMT ref: 6985ACF8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: type_info::operator!=
                                                                                                                                                                                                                                  • String ID: Modulus$PublicExponent
                                                                                                                                                                                                                                  • API String ID: 2241493438-3324115277
                                                                                                                                                                                                                                  • Opcode ID: 7506e82138fb7429aafd3bbaf514ac325655754e74421adf86aed8acdc3786b0
                                                                                                                                                                                                                                  • Instruction ID: 122c60479096ebc8a4ceb2b0ccf1277d1b89b74bdc53a487ddb75820268c1703
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7506e82138fb7429aafd3bbaf514ac325655754e74421adf86aed8acdc3786b0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6411C1709043049FC640DF7C888455BBBE8BFE6254F808A5EF4829B360DB35985DCBE2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69884230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69884241
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69884277
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
                                                                                                                                                                                                                                  • String ID: vector<bool> too long
                                                                                                                                                                                                                                  • API String ID: 1785806476-842332957
                                                                                                                                                                                                                                  • Opcode ID: 5310f42ea50a5cdf5fc971270474803957afa355708beaa4ab02452f4dc7efde
                                                                                                                                                                                                                                  • Instruction ID: c454b1016d86a1efe1b0637e7529dfa34e3e185e5e7e903a218d465ad41ca30b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5310f42ea50a5cdf5fc971270474803957afa355708beaa4ab02452f4dc7efde
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E901DFB2A041055FD714CF69DD908AEB3A9FBD4358F518B2EE52687640E731A908CAA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 69883840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 69883855
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 698890ED
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: __CxxThrowException@8.LIBCMT ref: 69889102
                                                                                                                                                                                                                                    • Part of subcall function 698890D8: std::exception::exception.LIBCMT ref: 69889113
                                                                                                                                                                                                                                  • _memmove.LIBCMT ref: 69883880
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000007.00000002.2682797446.0000000069821000.00000020.00000001.01000000.00000028.sdmp, Offset: 69820000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2682541606.0000000069820000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2684621508.00000000698A4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685071505.00000000698BE000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2685590288.00000000698C0000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2686012039.00000000698C1000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2687667698.00000000698C3000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CA000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2688110203.00000000698CC000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000007.00000002.2693648492.00000000698CE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_7_2_69820000_Fb9COhEBuDNRhtMnCgGo2QiL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
                                                                                                                                                                                                                                  • String ID: vector<T> too long
                                                                                                                                                                                                                                  • API String ID: 1785806476-3788999226
                                                                                                                                                                                                                                  • Opcode ID: 7c5a1f59411834d92e5eac30204208e81567477e1b952149778f817b70c108b2
                                                                                                                                                                                                                                  • Instruction ID: 18b2cd5d53b026680adc846310d8e7b64084202b8f32cd87a3825b219a2087e2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7c5a1f59411834d92e5eac30204208e81567477e1b952149778f817b70c108b2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2B0171B15006099FD324DFADDA8485AB3E8AB542507508E3EE9AAD3650EA71F8018B70
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%